MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (i.e., going to the err label) while executing the method create_worker_threads, the held lock thd->ctrl_mutex is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mariadb-serverUpgrade mariadb-pamUpgrade mariadb-embeddedUpgrade mariadb-commonUpgrade mariadb-testUpgrade mariadb-gssapi-serverUpgrade JudyUpgrade mariadbUpgrade mariadb-embedded-develUpgrade mariadb-develUpgrade mariadb-errmsgUpgrade mariadb-oqgraph-engineUpgrade mariadb-backupUpgrade mariadb-server-galeraUpgrade galeraUpgrade mariadb-server-utils | Aug 8, 2022 | May 25, 2022 |
| Alpine Linux | — | Upgrade mariadb | Mar 26, 2024 | May 25, 2022 |
| Amazon Linux Ami 2 | — | Upgrade mariadb-testUpgrade mariadb-errmsgUpgrade mariadb-backupUpgrade mariadb-oqgraph-engineUpgrade mariadb-pamUpgrade mariadb-gssapi-serverUpgrade mariadbUpgrade mariadb-connect-engineUpgrade mariadb-server-utilsUpgrade mariadb-sphinx-engineUpgrade mariadb-embeddedUpgrade mariadb-debuginfoUpgrade mariadb-libsUpgrade mariadb-s3-engineUpgrade mariadb-commonUpgrade mariadb-cracklib-password-checkUpgrade mariadb-develUpgrade mariadb-rocksdb-engineUpgrade mariadb-server-galeraUpgrade mariadb-embedded-develUpgrade mariadb-configUpgrade mariadb-server | Sep 28, 2023 | May 25, 2022 |
| Amazon_linux_2023 | — | Upgrade mariadb105-cracklib-password-checkUpgrade mariadb105-debuginfoUpgrade mariadb105-gssapi-serverUpgrade mariadb105-pamUpgrade mariadb105-connect-engine-debuginfoUpgrade mariadb105Upgrade mariadb105-commonUpgrade mariadb105-rocksdb-engine-debuginfoUpgrade mariadb105-backupUpgrade mariadb105-oqgraph-engineUpgrade mariadb105-sphinx-engineUpgrade mariadb105-server-utilsUpgrade mariadb105-backup-debuginfoUpgrade mariadb105-gssapi-server-debuginfoUpgrade mariadb105-pam-debuginfoUpgrade mariadb105-develUpgrade mariadb105-rocksdb-engineUpgrade mariadb105-server-utils-debuginfoUpgrade mariadb105-errmsgUpgrade mariadb105-test-debuginfoUpgrade mariadb105-cracklib-password-check-debuginfoUpgrade mariadb105-sphinx-engine-debuginfoUpgrade mariadb105-connect-engineUpgrade mariadb105-serverUpgrade mariadb105-oqgraph-engine-debuginfoUpgrade mariadb105-debugsourceUpgrade mariadb105-server-debuginfoUpgrade mariadb105-test | Feb 17, 2025 | Sep 7, 2021 |
| Centos_linux | — | Upgrade galera-debugsourceUpgrade mariadb-oqgraph-engineUpgrade mysql-selinuxUpgrade mariadb-serverUpgrade mariadb-embedded-develUpgrade mariadb-pam-debuginfoUpgrade mariadb-server-utilsUpgrade mariadb-server-debuginfoUpgrade Judy-debuginfoUpgrade mariadb-backup-debuginfoUpgrade mariadb-test-debuginfoUpgrade mariadb-embeddedUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-server-galeraUpgrade mariadb-develUpgrade galeraUpgrade mariadb-errmsgUpgrade Judy-debugsourceUpgrade mariadb-gssapi-serverUpgrade mariadb-backupUpgrade JudyUpgrade mariadb-commonUpgrade mariadb-debugsourceUpgrade mariadbUpgrade mariadb-embedded-debuginfoUpgrade galera-debuginfoUpgrade mariadb-testUpgrade mariadb-debuginfoUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-pamUpgrade mariadb-oqgraph-engine-debuginfo | Aug 3, 2022 | May 25, 2022 |
| Debian | — | Upgrade mariadb-10.5 | Jul 30, 2024 | May 25, 2022 |
| Gentoo Linux | — | Upgrade dev-db/mariadb. | May 10, 2024 | May 25, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade mariadbUpgrade mariadb-commonUpgrade mariadb-devel | Aug 18, 2022 | May 25, 2022 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Oct 13, 2025 | May 25, 2022 |
| Oracle_linux | — | Upgrade mariadb-serverUpgrade mariadb-gssapi-serverUpgrade mariadb-pamUpgrade mariadb-backupUpgrade mariadb-testUpgrade mariadb-errmsgUpgrade mariadb-commonUpgrade JudyUpgrade mariadbUpgrade mysql-selinuxUpgrade mariadb-embedded-develUpgrade mariadb-server-utilsUpgrade mariadb-develUpgrade mariadb-oqgraph-engineUpgrade mariadb-embeddedUpgrade mariadb-server-galeraUpgrade galera | Aug 4, 2022 | Sep 7, 2021 |
| Redhat_linux | — | Upgrade mariadb-debuginfoUpgrade mariadb-server-utilsUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-test-debuginfoUpgrade mariadb-embeddedUpgrade mariadb-server-galeraUpgrade mariadb-embedded-develNo solution existsUpgrade mariadb-backup-debuginfoUpgrade Judy-debuginfoUpgrade mariadb-develUpgrade mariadb-server-debuginfoUpgrade mariadb-pam-debuginfoUpgrade galera-debugsourceUpgrade mariadb-oqgraph-engineUpgrade mariadb-backupUpgrade mariadb-debugsourceUpgrade mariadb-serverUpgrade mariadbUpgrade mysql-selinuxUpgrade JudyUpgrade mariadb-commonUpgrade Judy-debugsourceUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-embedded-debuginfoUpgrade galera-debuginfoUpgrade galeraUpgrade mariadb-gssapi-serverUpgrade mariadb-testUpgrade mariadb-pam | Aug 3, 2022 | May 25, 2022 |
| Rocky_linux | — | Upgrade mariadb-embedded-debuginfoUpgrade mariadb-embedded-develUpgrade mariadb-backupUpgrade mariadb-test-debuginfoUpgrade galera-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-commonUpgrade mariadb-pamUpgrade JudyUpgrade mariadb-server-debuginfoUpgrade mariadb-oqgraph-engineUpgrade mariadb-server-galeraUpgrade mariadb-errmsgUpgrade mariadb-develUpgrade galeraUpgrade mariadb-gssapi-server-debuginfoUpgrade Judy-debugsourceUpgrade mariadb-embeddedUpgrade mariadb-debugsourceUpgrade mariadb-oqgraph-engine-debuginfoUpgrade Judy-debuginfoUpgrade mariadb-gssapi-serverUpgrade galera-debugsourceUpgrade mariadb-testUpgrade mariadb-pam-debuginfoUpgrade mariadb-debuginfoUpgrade mariadb-server-utilsUpgrade mariadb-backup-debuginfoUpgrade mariadb-serverUpgrade mariadb | Mar 12, 2024 | May 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub