MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16207.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade JudyUpgrade mariadb-commonUpgrade mariadb-errmsgUpgrade mariadbUpgrade mariadb-embedded-develUpgrade mariadb-pamUpgrade mariadb-server-galeraUpgrade mariadb-develUpgrade mariadb-backupUpgrade mariadb-gssapi-serverUpgrade mariadb-serverUpgrade mariadb-server-utilsUpgrade mariadb-testUpgrade mariadb-oqgraph-engineUpgrade galeraUpgrade mariadb-embedded | Aug 8, 2022 | Feb 18, 2022 |
| Alpine Linux | — | Upgrade mariadb | Aug 22, 2024 | Feb 18, 2022 |
| Amazon Linux Ami 2 | — | Upgrade mariadb-serverUpgrade mariadb-server-galeraUpgrade mariadb-backupUpgrade mariadb-libsUpgrade mariadb-gssapi-serverUpgrade mariadb-embedded-develUpgrade mariadb-errmsgUpgrade mariadb-connect-engineUpgrade mariadb-debuginfoUpgrade mariadb-commonUpgrade mariadbUpgrade mariadb-oqgraph-engineUpgrade mariadb-embeddedUpgrade mariadb-s3-engineUpgrade mariadb-configUpgrade mariadb-server-utilsUpgrade mariadb-testUpgrade mariadb-pamUpgrade mariadb-rocksdb-engineUpgrade mariadb-cracklib-password-checkUpgrade mariadb-develUpgrade mariadb-sphinx-engine | Sep 28, 2023 | Feb 18, 2022 |
| Amazon_linux_2023 | — | Upgrade mariadb105-connect-engineUpgrade mariadb105-commonUpgrade mariadb105-connect-engine-debuginfoUpgrade mariadb105-pamUpgrade mariadb105-sphinx-engine-debuginfoUpgrade mariadb105-serverUpgrade mariadb105-testUpgrade mariadb105-sphinx-engineUpgrade mariadb105-gssapi-serverUpgrade mariadb105-cracklib-password-checkUpgrade mariadb105-rocksdb-engine-debuginfoUpgrade mariadb105-server-utilsUpgrade mariadb105Upgrade mariadb105-gssapi-server-debuginfoUpgrade mariadb105-backup-debuginfoUpgrade mariadb105-oqgraph-engineUpgrade mariadb105-rocksdb-engineUpgrade mariadb105-pam-debuginfoUpgrade mariadb105-develUpgrade mariadb105-server-debuginfoUpgrade mariadb105-debugsourceUpgrade mariadb105-backupUpgrade mariadb105-debuginfoUpgrade mariadb105-test-debuginfoUpgrade mariadb105-oqgraph-engine-debuginfoUpgrade mariadb105-server-utils-debuginfoUpgrade mariadb105-errmsgUpgrade mariadb105-cracklib-password-check-debuginfo | Feb 17, 2025 | Feb 18, 2022 |
| Centos_linux | — | Upgrade Judy-debugsourceUpgrade mariadb-embeddedUpgrade mariadb-server-utilsUpgrade mariadb-testUpgrade mariadb-embedded-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-debugsourceUpgrade mariadb-oqgraph-engineUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-backup-debuginfoUpgrade mariadb-gssapi-serverUpgrade mariadb-pam-debuginfoUpgrade galeraUpgrade galera-debugsourceUpgrade Judy-debuginfoUpgrade mariadb-debuginfoUpgrade mysql-selinuxUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-serverUpgrade mariadbUpgrade mariadb-pamUpgrade mariadb-commonUpgrade mariadb-backupUpgrade mariadb-server-galeraUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-embedded-develUpgrade galera-debuginfoUpgrade mariadb-server-debuginfoUpgrade mariadb-develUpgrade JudyUpgrade mariadb-test-debuginfo | Aug 3, 2022 | Feb 18, 2022 |
| Debian | — | Upgrade mariadb-10.5 | Jul 30, 2024 | Feb 18, 2022 |
| Freebsd | — | Upgrade mariadb105-serverUpgrade mariadb103-clientUpgrade mariadb105-clientUpgrade mariadb103-serverUpgrade mariadb104-clientUpgrade mariadb104-server | Nov 4, 2022 | Feb 10, 2022 |
| Gentoo Linux | — | Upgrade dev-db/mariadb. | May 10, 2024 | Feb 18, 2022 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Mar 4, 2025 | Feb 18, 2022 |
| Oracle_linux | — | Upgrade mariadb-embeddedUpgrade mariadbUpgrade mariadb-errmsgUpgrade mariadb-server-utilsUpgrade mariadb-serverUpgrade mariadb-gssapi-serverUpgrade mariadb-testUpgrade mariadb-backupUpgrade mariadb-pamUpgrade mariadb-embedded-develUpgrade mariadb-server-galeraUpgrade mysql-selinuxUpgrade JudyUpgrade mariadb-develUpgrade mariadb-commonUpgrade galeraUpgrade mariadb-oqgraph-engine | Aug 4, 2022 | Feb 18, 2022 |
| Redhat_linux | — | Upgrade mariadb-pam-debuginfoUpgrade mariadbUpgrade galera-debugsourceUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-gssapi-serverUpgrade mariadb-oqgraph-engineUpgrade mariadb-debugsourceUpgrade mysql-selinuxUpgrade mariadb-server-debuginfoUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-embeddedUpgrade mariadb-debuginfoUpgrade mariadb-serverUpgrade galeraUpgrade mariadb-server-utilsUpgrade Judy-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-test-debuginfoUpgrade mariadb-backupUpgrade mariadb-backup-debuginfoUpgrade JudyUpgrade mariadb-testUpgrade mariadb-server-galeraUpgrade mariadb-embedded-develUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-develUpgrade mariadb-embedded-debuginfoNo solution existsUpgrade mariadb-pamUpgrade mariadb-commonUpgrade galera-debuginfoUpgrade Judy-debugsource | Aug 3, 2022 | Feb 18, 2022 |
| Rocky_linux | — | Upgrade mariadb-commonUpgrade mariadb-backup-debuginfoUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-server-debuginfoUpgrade mariadb-pamUpgrade mariadb-testUpgrade JudyUpgrade mariadb-debugsourceUpgrade mariadb-gssapi-server-debuginfoUpgrade Judy-debugsourceUpgrade galera-debuginfoUpgrade mariadbUpgrade mariadb-embeddedUpgrade mariadb-server-galeraUpgrade mariadb-develUpgrade galeraUpgrade galera-debugsourceUpgrade mariadb-errmsgUpgrade mariadb-pam-debuginfoUpgrade mariadb-test-debuginfoUpgrade mariadb-embedded-debuginfoUpgrade mariadb-server-utilsUpgrade mariadb-debuginfoUpgrade mariadb-gssapi-serverUpgrade mariadb-backupUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-serverUpgrade mariadb-oqgraph-engineUpgrade Judy-debuginfoUpgrade mariadb-embedded-devel | Mar 12, 2024 | Feb 18, 2022 |
| Suse | — | Upgrade mariadb-benchUpgrade libmariadbd-develUpgrade libmariadb_pluginsUpgrade libmariadb3Upgrade mariadb-errormessagesUpgrade mariadb104-galeraUpgrade mariadb104-testUpgrade mariadbUpgrade mariadb104-clientUpgrade libmysqld19Upgrade libmariadbd104-develUpgrade mariadb104-rpm-macrosUpgrade mariadb-clientUpgrade python3-mysqlclientUpgrade liblz4-1Upgrade mariadb-toolsUpgrade mariadb104-errormessagesUpgrade mariadb104Upgrade mariadb104-benchUpgrade libmariadbd19Upgrade libmariadb-develUpgrade libmysqld-develUpgrade mariadb-rpm-macrosUpgrade mariadb-testUpgrade mariadb-galeraUpgrade mariadb104-tools | Mar 5, 2022 | Feb 18, 2022 |
| Ubuntu | — | Upgrade mariadb-server | Mar 22, 2023 | Feb 18, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 18, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub