MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (i.e., going to the err label) while executing the method create_worker_threads, the held lock thd->ctrl_mutex is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mariadb-server-galeraUpgrade mariadb-embedded-develUpgrade mariadb-backupUpgrade galeraUpgrade mariadb-develUpgrade mariadb-server-utilsUpgrade mariadb-errmsgUpgrade mariadb-oqgraph-engineUpgrade JudyUpgrade mariadbUpgrade mariadb-embeddedUpgrade mariadb-pamUpgrade mariadb-commonUpgrade mariadb-testUpgrade mariadb-gssapi-serverUpgrade mariadb-server | Aug 8, 2022 | May 25, 2022 |
| Alpine Linux | — | Upgrade mariadb | Mar 26, 2024 | May 25, 2022 |
| Amazon Linux Ami 2 | — | Upgrade mariadb-embedded-develUpgrade mariadb-libsUpgrade mariadb-cracklib-password-checkUpgrade mariadb-s3-engineUpgrade mariadb-serverUpgrade mariadb-commonUpgrade mariadb-server-galeraUpgrade mariadb-develUpgrade mariadb-configUpgrade mariadb-rocksdb-engineUpgrade mariadb-embeddedUpgrade mariadb-server-utilsUpgrade mariadb-oqgraph-engineUpgrade mariadb-testUpgrade mariadb-connect-engineUpgrade mariadb-debuginfoUpgrade mariadb-pamUpgrade mariadbUpgrade mariadb-errmsgUpgrade mariadb-gssapi-serverUpgrade mariadb-backupUpgrade mariadb-sphinx-engine | Sep 28, 2023 | May 25, 2022 |
| Amazon_linux_2023 | — | Upgrade mariadb105-pamUpgrade mariadb105-connect-engine-debuginfoUpgrade mariadb105-debuginfoUpgrade mariadb105-commonUpgrade mariadb105-server-utilsUpgrade mariadb105-cracklib-password-checkUpgrade mariadb105-backupUpgrade mariadb105-backup-debuginfoUpgrade mariadb105-gssapi-serverUpgrade mariadb105-gssapi-server-debuginfoUpgrade mariadb105-rocksdb-engine-debuginfoUpgrade mariadb105-sphinx-engineUpgrade mariadb105Upgrade mariadb105-oqgraph-engineUpgrade mariadb105-develUpgrade mariadb105-server-utils-debuginfoUpgrade mariadb105-test-debuginfoUpgrade mariadb105-pam-debuginfoUpgrade mariadb105-cracklib-password-check-debuginfoUpgrade mariadb105-sphinx-engine-debuginfoUpgrade mariadb105-connect-engineUpgrade mariadb105-rocksdb-engineUpgrade mariadb105-oqgraph-engine-debuginfoUpgrade mariadb105-testUpgrade mariadb105-server-debuginfoUpgrade mariadb105-serverUpgrade mariadb105-debugsourceUpgrade mariadb105-errmsg | Feb 17, 2025 | Sep 7, 2021 |
| Centos_linux | — | Upgrade mariadb-develUpgrade mariadb-server-utilsUpgrade mariadb-embeddedUpgrade mariadb-backup-debuginfoUpgrade galera-debugsourceUpgrade mariadb-serverUpgrade mariadb-test-debuginfoUpgrade galeraUpgrade Judy-debuginfoUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-oqgraph-engineUpgrade mysql-selinuxUpgrade mariadb-server-debuginfoUpgrade mariadb-embedded-develUpgrade mariadb-pam-debuginfoUpgrade mariadb-server-galeraUpgrade mariadb-debuginfoUpgrade mariadb-testUpgrade Judy-debugsourceUpgrade mariadb-embedded-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-pamUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-gssapi-serverUpgrade mariadb-commonUpgrade JudyUpgrade mariadb-backupUpgrade mariadb-debugsourceUpgrade mariadbUpgrade galera-debuginfo | Aug 3, 2022 | May 25, 2022 |
| Debian | — | Upgrade mariadb-10.5 | Jul 30, 2024 | May 25, 2022 |
| Gentoo Linux | — | Upgrade dev-db/mariadb. | May 10, 2024 | May 25, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade mariadb-commonUpgrade mariadb-develUpgrade mariadb | Aug 18, 2022 | May 25, 2022 |
| Mariadb Mariadb | — | Upgrade MariaDB to the latest version | Oct 13, 2025 | May 25, 2022 |
| Oracle_linux | — | Upgrade mariadb-embeddedUpgrade mariadb-oqgraph-engineUpgrade galeraUpgrade mariadb-server-utilsUpgrade mariadb-server-galeraUpgrade mysql-selinuxUpgrade mariadb-develUpgrade mariadb-embedded-develUpgrade mariadb-testUpgrade mariadb-errmsgUpgrade JudyUpgrade mariadbUpgrade mariadb-pamUpgrade mariadb-gssapi-serverUpgrade mariadb-backupUpgrade mariadb-commonUpgrade mariadb-server | Aug 4, 2022 | Sep 7, 2021 |
| Redhat_linux | — | Upgrade mariadb-server-utils-debuginfoUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-develUpgrade Judy-debuginfoUpgrade mariadb-debuginfoUpgrade mariadb-embedded-develNo solution existsUpgrade mariadb-embeddedUpgrade mariadb-server-debuginfoUpgrade mariadb-backup-debuginfoUpgrade mariadb-server-galeraUpgrade mariadb-server-utilsUpgrade mariadb-test-debuginfoUpgrade mariadb-pam-debuginfoUpgrade mariadb-pamUpgrade mariadb-errmsgUpgrade galera-debugsourceUpgrade galeraUpgrade mariadb-gssapi-serverUpgrade JudyUpgrade mariadb-debugsourceUpgrade mysql-selinuxUpgrade mariadb-backupUpgrade mariadb-testUpgrade Judy-debugsourceUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-embedded-debuginfoUpgrade mariadbUpgrade mariadb-serverUpgrade mariadb-oqgraph-engineUpgrade mariadb-commonUpgrade galera-debuginfo | Aug 3, 2022 | May 25, 2022 |
| Rocky_linux | — | Upgrade Judy-debuginfoUpgrade mariadb-pam-debuginfoUpgrade galeraUpgrade galera-debugsourceUpgrade mariadb-debuginfoUpgrade mariadb-testUpgrade mariadb-gssapi-serverUpgrade mariadbUpgrade Judy-debugsourceUpgrade mariadb-embeddedUpgrade mariadb-backup-debuginfoUpgrade mariadb-server-utilsUpgrade mariadb-oqgraph-engine-debuginfoUpgrade mariadb-serverUpgrade mariadb-debugsourceUpgrade mariadb-gssapi-server-debuginfoUpgrade mariadb-errmsgUpgrade mariadb-oqgraph-engineUpgrade mariadb-server-debuginfoUpgrade galera-debuginfoUpgrade JudyUpgrade mariadb-pamUpgrade mariadb-commonUpgrade mariadb-server-utils-debuginfoUpgrade mariadb-embedded-develUpgrade mariadb-test-debuginfoUpgrade mariadb-embedded-debuginfoUpgrade mariadb-backupUpgrade mariadb-develUpgrade mariadb-server-galera | Mar 12, 2024 | May 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub