MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (i.e., going to the err label) while executing the method create_worker_threads, the held lock thd->ctrl_mutex is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mariadbUpgrade mariadb-develUpgrade mariadb-server-utilsUpgrade mariadb-errmsgUpgrade mariadb-backupUpgrade JudyUpgrade galeraUpgrade mariadb-server-galeraUpgrade mariadb-oqgraph-engineUpgrade mariadb-embedded-develUpgrade mariadb-gssapi-serverUpgrade mariadb-serverUpgrade mariadb-embeddedUpgrade mariadb-pamUpgrade mariadb-testUpgrade mariadb-common | Aug 8, 2022 | May 25, 2022 |
| Alpine Linux | — | Upgrade mariadb | Mar 26, 2024 | May 25, 2022 |
| Amazon Linux Ami 2 | — | Upgrade mariadb-server-galeraUpgrade mariadb-configUpgrade mariadb-s3-engineUpgrade mariadb-serverUpgrade mariadb-develUpgrade mariadb-rocksdb-engineUpgrade mariadb-cracklib-password-checkUpgrade mariadb-embedded-develUpgrade mariadb-libsUpgrade mariadb-commonUpgrade mariadb-errmsgUpgrade mariadb-pamUpgrade mariadb-embeddedUpgrade mariadb-server-utilsUpgrade mariadb-debuginfoUpgrade mariadbUpgrade mariadb-sphinx-engineUpgrade mariadb-backupUpgrade mariadb-gssapi-serverUpgrade mariadb-connect-engineUpgrade mariadb-testUpgrade mariadb-oqgraph-engine | Sep 28, 2023 | May 25, 2022 |
| Amazon_linux_2023 | — | Upgrade mariadb105-connect-engineUpgrade mariadb105-cracklib-password-check-debuginfoUpgrade mariadb105-sphinx-engine-debuginfoUpgrade mariadb105-pam-debuginfoUpgrade mariadb105-server-debuginfoUpgrade mariadb105-test-debuginfoUpgrade mariadb105-debugsourceUpgrade mariadb105-oqgraph-engine-debuginfoUpgrade mariadb105-errmsgUpgrade mariadb105-server-utils-debuginfoUpgrade mariadb105-develUpgrade mariadb105-testUpgrade mariadb105-rocksdb-engineUpgrade mariadb105-serverUpgrade mariadb105-pamUpgrade mariadb105-gssapi-serverUpgrade mariadb105-rocksdb-engine-debuginfoUpgrade mariadb105-debuginfoUpgrade mariadb105-backupUpgrade mariadb105Upgrade mariadb105-oqgraph-engineUpgrade mariadb105-gssapi-server-debuginfoUpgrade mariadb105-backup-debuginfoUpgrade mariadb105-server-utilsUpgrade mariadb105-connect-engine-debuginfoUpgrade mariadb105-sphinx-engineUpgrade mariadb105-commonUpgrade mariadb105-cracklib-password-check | Feb 17, 2025 | Sep 7, 2021 |
| Centos_linux | — | Upgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-gssapi-serverUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-debugsourceUpgrade mariadb-pamUpgrade mariadb-commonUpgrade mariadb-embedded-debuginfoUpgrade Judy-debugsourceUpgrade mariadb-testUpgrade galera-debuginfoUpgrade mariadbUpgrade JudyUpgrade mariadb-debuginfoUpgrade mariadb-backupUpgrade mariadb-server-debuginfoUpgrade mariadb-oqgraph-engineUpgrade mysql-selinuxUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-pam-debuginfoUpgrade mariadb-embedded-develUpgrade mariadb-embeddedUpgrade mariadb-serverUpgrade galera-debugsourceUpgrade mariadb-test-debuginfoUpgrade mariadb-develUpgrade mariadb-backup-debuginfoUpgrade mariadb-server-utilsUpgrade mariadb-server-galeraUpgrade Judy-debuginfoUpgrade galera | Aug 3, 2022 | May 25, 2022 |
| Debian | — | Upgrade mariadb-10.5 | Jul 30, 2024 | May 25, 2022 |
| Gentoo Linux | — | Upgrade dev-db/mariadb. | May 10, 2024 | May 25, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade mariadbUpgrade mariadb-develUpgrade mariadb-common | Aug 18, 2022 | May 25, 2022 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Oct 13, 2025 | May 25, 2022 |
| Oracle_linux | — | Upgrade mariadb-embeddedUpgrade mariadb-oqgraph-engineUpgrade mariadb-embedded-develUpgrade mysql-selinuxUpgrade mariadb-develUpgrade galeraUpgrade mariadb-server-utilsUpgrade mariadb-server-galeraUpgrade mariadbUpgrade mariadb-testUpgrade mariadb-errmsgUpgrade JudyUpgrade mariadb-pamUpgrade mariadb-serverUpgrade mariadb-gssapi-serverUpgrade mariadb-commonUpgrade mariadb-backup | Aug 4, 2022 | Sep 7, 2021 |
| Redhat_linux | — | Upgrade mariadb-backup-debuginfoUpgrade mariadb-embeddedUpgrade mariadb-embedded-develNo solution existsUpgrade mariadb-develUpgrade mariadb-server-galeraUpgrade mariadb-server-utilsUpgrade Judy-debuginfoUpgrade mariadb-pam-debuginfoUpgrade mariadb-server-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-debuginfoUpgrade mariadb-test-debuginfoUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mysql-selinuxUpgrade mariadb-embedded-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-commonUpgrade mariadb-testUpgrade mariadb-pamUpgrade mariadb-gssapi-serverUpgrade mariadb-debugsourceUpgrade mariadb-backupUpgrade galera-debuginfoUpgrade galeraUpgrade mariadbUpgrade mariadb-serverUpgrade galera-debugsourceUpgrade mariadb-oqgraph-engineUpgrade JudyUpgrade Judy-debugsource | Aug 3, 2022 | May 25, 2022 |
| Rocky_linux | — | Upgrade mariadb-debuginfoUpgrade mariadb-embeddedUpgrade mariadb-serverUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-debugsourceUpgrade mariadbUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-testUpgrade Judy-debuginfoUpgrade mariadb-backup-debuginfoUpgrade mariadb-gssapi-serverUpgrade mariadb-server-utilsUpgrade mariadb-pam-debuginfoUpgrade galera-debugsourceUpgrade galeraUpgrade Judy-debugsourceUpgrade mariadb-pamUpgrade galera-debuginfoUpgrade mariadb-server-debuginfoUpgrade mariadb-develUpgrade mariadb-errmsgUpgrade mariadb-server-galeraUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-commonUpgrade JudyUpgrade mariadb-embedded-debuginfoUpgrade mariadb-backupUpgrade mariadb-embedded-develUpgrade mariadb-test-debuginfoUpgrade mariadb-oqgraph-engine | Mar 12, 2024 | May 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub