MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occurs (stream_ctxt->dest_file == NULL) while executing the method xbstream_open, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade mariadb | Mar 26, 2024 | May 25, 2022 |
| Centos_linux | — | Upgrade mariadb-server-utilsUpgrade mariadbUpgrade mariadb-oqgraph-engineUpgrade mariadb-pam-debuginfoUpgrade mariadb-embedded-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade galera-debugsourceUpgrade mariadb-serverUpgrade Judy-debuginfoUpgrade mariadb-embedded-develUpgrade JudyUpgrade mariadb-commonUpgrade mariadb-develUpgrade mariadb-server-galeraUpgrade mariadb-backupUpgrade mariadb-errmsgUpgrade mariadb-embeddedUpgrade mariadb-test-debuginfoUpgrade galeraUpgrade mariadb-testUpgrade mariadb-server-debuginfoUpgrade mariadb-pamUpgrade mariadb-backup-debuginfoUpgrade mariadb-gssapi-serverUpgrade mariadb-debugsourceUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-debuginfoUpgrade Judy-debugsourceUpgrade galera-debuginfoUpgrade mariadb-gssapi-server-debuginfo | Jun 14, 2022 | May 25, 2022 |
| Debian | — | Upgrade mariadb-10.5 | Jul 30, 2024 | May 25, 2022 |
| Gentoo Linux | — | Upgrade dev-db/mariadb. | May 10, 2024 | May 25, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade mariadb-develUpgrade mariadbUpgrade mariadb-common | Aug 18, 2022 | May 25, 2022 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Oct 13, 2025 | May 25, 2022 |
| Redhat_linux | — | Upgrade mariadb-embeddedUpgrade mariadb-debugsourceUpgrade mariadb-debuginfoUpgrade mariadb-develUpgrade mariadb-server-utilsUpgrade mariadb-backup-debuginfoUpgrade mariadb-pamUpgrade mariadb-test-debuginfoUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-pam-debuginfoUpgrade mariadbUpgrade mariadb-gssapi-serverUpgrade mariadb-server-debuginfoUpgrade Judy-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-server-galeraUpgrade mariadb-embedded-develUpgrade mariadb-errmsgUpgrade mariadb-backupNo solution existsUpgrade mariadb-embedded-debuginfoUpgrade mariadb-serverUpgrade galeraUpgrade galera-debuginfoUpgrade mariadb-testUpgrade JudyUpgrade mariadb-commonUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-oqgraph-engineUpgrade Judy-debugsourceUpgrade galera-debugsource | Jun 14, 2022 | May 25, 2022 |
| Rocky_linux | — | Upgrade mariadb-develUpgrade mariadb-test-debuginfoUpgrade Judy-debugsourceUpgrade mariadb-embedded-develUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-serverUpgrade mariadb-pam-debuginfoUpgrade mariadb-backupUpgrade Judy-debuginfoUpgrade mariadb-embedded-debuginfoUpgrade galeraUpgrade mariadb-errmsgUpgrade mariadb-oqgraph-engineUpgrade mariadb-server-galeraUpgrade mariadb-debuginfoUpgrade mariadb-embeddedUpgrade mariadbUpgrade galera-debugsourceUpgrade mariadb-commonUpgrade mariadb-debugsourceUpgrade mariadb-testUpgrade mariadb-pamUpgrade mariadb-backup-debuginfoUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-server-debuginfoUpgrade mariadb-server-utilsUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-gssapi-serverUpgrade galera-debuginfoUpgrade Judy | Mar 5, 2024 | May 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub