MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (i.e., going to the err label) while executing the method create_worker_threads, the held lock thd->ctrl_mutex is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mariadbUpgrade mariadb-backupUpgrade mariadb-errmsgUpgrade mariadb-server-utilsUpgrade mariadb-oqgraph-engineUpgrade mariadb-embedded-develUpgrade mariadb-server-galeraUpgrade galeraUpgrade JudyUpgrade mariadb-develUpgrade mariadb-pamUpgrade mariadb-testUpgrade mariadb-commonUpgrade mariadb-serverUpgrade mariadb-embeddedUpgrade mariadb-gssapi-server | Aug 8, 2022 | May 25, 2022 |
| Alpine Linux | — | Upgrade mariadb | Mar 26, 2024 | May 25, 2022 |
| Amazon Linux Ami 2 | — | Upgrade mariadb-develUpgrade mariadb-s3-engineUpgrade mariadb-embedded-develUpgrade mariadb-cracklib-password-checkUpgrade mariadb-configUpgrade mariadb-serverUpgrade mariadb-rocksdb-engineUpgrade mariadb-libsUpgrade mariadb-server-galeraUpgrade mariadb-commonUpgrade mariadb-embeddedUpgrade mariadb-testUpgrade mariadb-pamUpgrade mariadb-backupUpgrade mariadb-connect-engineUpgrade mariadb-errmsgUpgrade mariadb-sphinx-engineUpgrade mariadb-server-utilsUpgrade mariadb-debuginfoUpgrade mariadbUpgrade mariadb-oqgraph-engineUpgrade mariadb-gssapi-server | Sep 28, 2023 | May 25, 2022 |
| Amazon_linux_2023 | — | Upgrade mariadb105-backup-debuginfoUpgrade mariadb105-commonUpgrade mariadb105-gssapi-server-debuginfoUpgrade mariadb105-oqgraph-engineUpgrade mariadb105-sphinx-engineUpgrade mariadb105-server-utilsUpgrade mariadb105Upgrade mariadb105-debuginfoUpgrade mariadb105-connect-engine-debuginfoUpgrade mariadb105-backupUpgrade mariadb105-rocksdb-engine-debuginfoUpgrade mariadb105-gssapi-serverUpgrade mariadb105-pamUpgrade mariadb105-cracklib-password-checkUpgrade mariadb105-server-utils-debuginfoUpgrade mariadb105-errmsgUpgrade mariadb105-pam-debuginfoUpgrade mariadb105-cracklib-password-check-debuginfoUpgrade mariadb105-serverUpgrade mariadb105-testUpgrade mariadb105-server-debuginfoUpgrade mariadb105-connect-engineUpgrade mariadb105-oqgraph-engine-debuginfoUpgrade mariadb105-sphinx-engine-debuginfoUpgrade mariadb105-debugsourceUpgrade mariadb105-rocksdb-engineUpgrade mariadb105-develUpgrade mariadb105-test-debuginfo | Feb 17, 2025 | Sep 7, 2021 |
| Centos_linux | — | Upgrade mariadb-develUpgrade mariadb-backup-debuginfoUpgrade mariadb-server-utilsUpgrade mariadb-embedded-develUpgrade mariadb-server-debuginfoUpgrade mariadb-serverUpgrade mariadb-server-galeraUpgrade galera-debugsourceUpgrade mariadb-embeddedUpgrade mariadb-pam-debuginfoUpgrade galeraUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-oqgraph-engineUpgrade mysql-selinuxUpgrade Judy-debuginfoUpgrade mariadb-test-debuginfoUpgrade mariadb-debugsourceUpgrade JudyUpgrade mariadb-debuginfoUpgrade mariadb-commonUpgrade mariadb-gssapi-serverUpgrade mariadb-backupUpgrade mariadb-testUpgrade mariadb-embedded-debuginfoUpgrade mariadb-pamUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-errmsgUpgrade mariadbUpgrade galera-debuginfoUpgrade Judy-debugsource | Aug 3, 2022 | May 25, 2022 |
| Debian | — | Upgrade mariadb-10.5 | Jul 30, 2024 | May 25, 2022 |
| Gentoo Linux | — | Upgrade dev-db/mariadb. | May 10, 2024 | May 25, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade mariadb-commonUpgrade mariadb-develUpgrade mariadb | Aug 18, 2022 | May 25, 2022 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Oct 13, 2025 | May 25, 2022 |
| Oracle_linux | — | Upgrade mariadb-server-utilsUpgrade mariadb-server-galeraUpgrade mariadb-embeddedUpgrade mysql-selinuxUpgrade mariadb-embedded-develUpgrade mariadb-oqgraph-engineUpgrade galeraUpgrade mariadb-develUpgrade mariadb-gssapi-serverUpgrade mariadb-errmsgUpgrade mariadb-pamUpgrade mariadb-backupUpgrade JudyUpgrade mariadbUpgrade mariadb-commonUpgrade mariadb-testUpgrade mariadb-server | Aug 4, 2022 | Sep 7, 2021 |
| Redhat_linux | — | Upgrade mariadb-testUpgrade mariadb-pamUpgrade mariadb-serverUpgrade mariadbUpgrade mariadb-gssapi-serverUpgrade galeraUpgrade mariadb-backupUpgrade galera-debugsourceUpgrade mariadb-errmsgUpgrade mysql-selinuxUpgrade mariadb-oqgraph-engineUpgrade mariadb-debugsourceUpgrade Judy-debugsourceUpgrade galera-debuginfoUpgrade mariadb-oqgraph-engine-debuginfoUpgrade JudyUpgrade mariadb-embedded-debuginfoUpgrade mariadb-commonUpgrade mariadb-server-utilsUpgrade mariadb-pam-debuginfoUpgrade mariadb-backup-debuginfoUpgrade mariadb-embedded-develUpgrade mariadb-embeddedUpgrade Judy-debuginfoUpgrade mariadb-develUpgrade mariadb-server-utils-debuginfoNo solution existsUpgrade mariadb-debuginfoUpgrade mariadb-server-debuginfoUpgrade mariadb-test-debuginfoUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-server-galera | Aug 3, 2022 | May 25, 2022 |
| Rocky_linux | — | Upgrade mariadb-develUpgrade galera-debuginfoUpgrade mariadb-pamUpgrade mariadb-embedded-debuginfoUpgrade mariadb-backupUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-oqgraph-engineUpgrade mariadb-embedded-develUpgrade mariadb-test-debuginfoUpgrade mariadb-server-galeraUpgrade mariadb-server-debuginfoUpgrade JudyUpgrade mariadb-commonUpgrade mariadb-testUpgrade mariadb-debugsourceUpgrade mariadb-debuginfoUpgrade mariadb-gssapi-serverUpgrade galeraUpgrade Judy-debuginfoUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-backup-debuginfoUpgrade Judy-debugsourceUpgrade mariadb-server-utilsUpgrade mariadb-gssapi-server-debuginfoUpgrade galera-debugsourceUpgrade mariadb-pam-debuginfoUpgrade mariadbUpgrade mariadb-serverUpgrade mariadb-embedded | Mar 12, 2024 | May 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub