CVE-2022-31622: Medium severity mariadb server vulnerability
MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/dscompress.cc, when an error occurs (pthreadcreate returns a nonzero value) while executing the method createworkerthreads, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this Denial of Service vulnerability in MariaDB Server?
The vulnerability ID for this Denial of Service vulnerability in MariaDB Server is CVE-2022-31622.
How severe is the Denial of Service vulnerability in MariaDB Server (CVE-2022-31622)?
The severity of the Denial of Service vulnerability in MariaDB Server (CVE-2022-31622) is medium with a severity value of 5.5.
Which versions of MariaDB Server are affected by the Denial of Service vulnerability (CVE-2022-31622)?
The versions of MariaDB Server affected by the Denial of Service vulnerability (CVE-2022-31622) are 10.2.42, 10.3.0 to 10.3.33, 10.4.0 to 10.4.23, 10.5.0 to 10.5.14, 10.6.0 to 10.6.6, and 10.7.0 to 10.7.2.
How can local users exploit the Denial of Service vulnerability in MariaDB Server (CVE-2022-31622)?
Local users can exploit the Denial of Service vulnerability in MariaDB Server (CVE-2022-31622) by triggering an error in the create_worker_threads method in extra/mariabackup/ds_compress.cc, which causes the held lock to not be released correctly.
What is the fix for the Denial of Service vulnerability in MariaDB Server (CVE-2022-31622)?
To fix the Denial of Service vulnerability in MariaDB Server (CVE-2022-31622), upgrade to version 10.7.2 or apply the appropriate patch provided by the vendor.