CVE-2021-35610: Oracle MySQL Server DOS Vulnerability

CVE-2021-35610 Overview

CVE-2021-35610 is a vulnerability in the MySQL Server product of Oracle MySQL, specifically affecting the Server: Optimizer component. This easily exploitable flaw allows a low-privileged attacker with network access via multiple protocols to compromise MySQL Server instances. Successful exploitation can result in a complete denial of service (DoS) through server hang or frequently repeatable crash, as well as unauthorized modification of MySQL Server accessible data through update, insert, or delete operations.

Critical Impact

A low-privileged attacker can cause complete service disruption and unauthorized data modification in MySQL Server versions 8.0.26 and prior.

Affected Products

• Oracle MySQL Server 8.0.26 and prior versions
• NetApp OnCommand Insight
• NetApp SnapCenter
• Fedora 33, 34, and 35

Discovery Timeline

• October 20, 2021 - CVE-2021-35610 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-35610

Vulnerability Analysis

This vulnerability resides within the Optimizer component of MySQL Server, which is responsible for analyzing SQL queries and determining the most efficient execution plan. The flaw allows attackers with low-privilege database access to craft specific queries or operations that trigger undefined behavior in the optimizer, leading to server instability.

The attack is particularly concerning because it combines availability and integrity impacts. An attacker can not only cause the database server to crash or hang indefinitely but also manipulate data within the MySQL Server's accessible scope. The network-based attack vector means any authenticated user with basic database privileges can potentially exploit this vulnerability from a remote location without requiring any user interaction.

Root Cause

The root cause lies in improper handling within the MySQL Server Optimizer component. While specific details have not been disclosed by Oracle (classified as NVD-CWE-noinfo), the vulnerability stems from how the optimizer processes certain query patterns or optimization paths. This can lead to resource exhaustion, infinite loops, or memory corruption that results in server crashes and potential data integrity violations.

Attack Vector

The attack can be executed over the network through standard MySQL connection protocols. An attacker requires:

1. Valid database credentials with low-level privileges
2. Network connectivity to the MySQL Server instance
3. Ability to execute queries that trigger the vulnerable optimizer code path

The exploitation does not require any user interaction and can be repeated easily once the attack vector is identified. The vulnerability affects the unchanged scope, meaning the impact is limited to the MySQL Server component itself.

Due to the nature of this vulnerability and the absence of verified proof-of-concept code, the specific exploitation mechanism involves crafting SQL queries that cause the optimizer to enter an unstable state. Organizations should refer to the Oracle Security Advisory for detailed technical information about the affected code paths.

Detection Methods for CVE-2021-35610

Indicators of Compromise

• Unexpected MySQL Server crashes or hangs with no apparent resource constraints
• Unusual query patterns targeting optimizer-heavy operations from authenticated sessions
• Database error logs showing optimizer-related failures or abnormal terminations
• Unauthorized data modifications detected in audit logs

Detection Strategies

• Monitor MySQL error logs for recurring crashes with optimizer-related stack traces
• Implement database activity monitoring to detect anomalous query patterns from low-privilege users
• Configure alerts for unexpected MySQL service restarts or high availability failovers
• Review authentication logs for suspicious access patterns from known or compromised accounts

Monitoring Recommendations

• Enable MySQL General Query Log or Slow Query Log to capture potentially malicious queries
• Deploy SentinelOne agents on database servers to detect exploitation attempts and anomalous process behavior
• Implement network-level monitoring for unusual MySQL protocol traffic patterns
• Establish baseline metrics for MySQL Server performance to identify deviation during attack attempts

How to Mitigate CVE-2021-35610

Immediate Actions Required

• Upgrade MySQL Server to version 8.0.27 or later as recommended by Oracle
• Review and restrict database user privileges to minimum required access levels
• Implement network segmentation to limit direct access to MySQL Server instances
• Enable comprehensive logging and monitoring on all MySQL deployments

Patch Information

Oracle has addressed this vulnerability in the October 2021 Critical Patch Update (CPU). Organizations should apply the latest security patches available through the Oracle Security Alerts page. For downstream products:

• NetApp users: Refer to the NetApp Security Advisory for OnCommand Insight and SnapCenter updates
• Fedora users: Apply updates through standard package management as announced in Fedora Package Announcements for Fedora 33, 34, and 35

Workarounds

• Implement strict network access controls to limit MySQL Server exposure to trusted hosts only
• Enforce principle of least privilege by auditing and reducing database user permissions
• Deploy a web application firewall or database firewall capable of detecting malicious query patterns
• Consider implementing query throttling for non-administrative database accounts

# Configuration example - Restrict MySQL network access
# Edit /etc/mysql/mysql.conf.d/mysqld.cnf
bind-address = 127.0.0.1  # Restrict to localhost only
# Or specify trusted network interface IP

# Limit user privileges - Example MySQL commands
# REVOKE ALL PRIVILEGES ON *.* FROM 'limited_user'@'%';
# GRANT SELECT, INSERT ON specific_db.* TO 'limited_user'@'trusted_host';
# FLUSH PRIVILEGES;