MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occurs (stream_ctxt->dest_file == NULL) while executing the method xbstream_open, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade mariadb | Mar 26, 2024 | May 25, 2022 |
| Centos_linux | — | Upgrade mariadb-backupUpgrade galeraUpgrade mariadb-server-utils-debuginfoUpgrade Judy-debuginfoUpgrade mariadb-embedded-debuginfoUpgrade mariadb-embeddedUpgrade mariadb-test-debuginfoUpgrade JudyUpgrade galera-debugsourceUpgrade mariadb-oqgraph-engineUpgrade mariadb-server-utilsUpgrade mariadb-server-galeraUpgrade mariadb-commonUpgrade mariadb-develUpgrade mariadb-errmsgUpgrade mariadb-embedded-develUpgrade mariadb-serverUpgrade mariadbUpgrade mariadb-pam-debuginfoUpgrade mariadb-debugsourceUpgrade mariadb-debuginfoUpgrade mariadb-gssapi-serverUpgrade mariadb-backup-debuginfoUpgrade mariadb-pamUpgrade mariadb-testUpgrade mariadb-gssapi-server-debuginfoUpgrade galera-debuginfoUpgrade Judy-debugsourceUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-server-debuginfo | Jun 14, 2022 | May 25, 2022 |
| Debian | — | Upgrade mariadb-10.5 | Jul 30, 2024 | May 25, 2022 |
| Gentoo Linux | — | Upgrade dev-db/mariadb. | May 10, 2024 | May 25, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade mariadb-develUpgrade mariadb-commonUpgrade mariadb | Aug 18, 2022 | May 25, 2022 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Oct 13, 2025 | May 25, 2022 |
| Redhat_linux | — | Upgrade mariadb-gssapi-serverUpgrade mariadb-server-utilsUpgrade mariadb-server-debuginfoUpgrade Judy-debuginfoUpgrade mariadbUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-develUpgrade mariadb-debuginfoUpgrade mariadb-test-debuginfoUpgrade mariadb-debugsourceUpgrade mariadb-pam-debuginfoUpgrade mariadb-backup-debuginfoUpgrade mariadb-pamUpgrade mariadb-embeddedUpgrade mariadb-server-galeraUpgrade mariadb-testUpgrade Judy-debugsourceUpgrade galera-debuginfoUpgrade mariadb-embedded-debuginfoUpgrade JudyUpgrade mariadb-backupUpgrade mariadb-embedded-develNo solution existsUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-commonUpgrade mariadb-oqgraph-engineUpgrade mariadb-serverUpgrade galeraUpgrade galera-debugsource | Jun 14, 2022 | May 25, 2022 |
| Rocky_linux | — | Upgrade mariadb-server-galeraUpgrade mariadb-backupUpgrade mariadb-errmsgUpgrade mariadbUpgrade Judy-debugsourceUpgrade mariadb-embedded-develUpgrade mariadb-serverUpgrade mariadb-test-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-develUpgrade mariadb-pam-debuginfoUpgrade mariadb-commonUpgrade mariadb-debugsourceUpgrade galeraUpgrade mariadb-embedded-debuginfoUpgrade mariadb-debuginfoUpgrade mariadb-oqgraph-engineUpgrade mariadb-embeddedUpgrade galera-debugsourceUpgrade Judy-debuginfoUpgrade mariadb-server-utilsUpgrade galera-debuginfoUpgrade JudyUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-pamUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-backup-debuginfoUpgrade mariadb-gssapi-serverUpgrade mariadb-server-debuginfoUpgrade mariadb-test | Mar 5, 2024 | May 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub