CVE-2021-35610: Oracle MySQL Server DOS Vulnerability

CVE-2021-35610 Overview

CVE-2021-35610 is a high-severity vulnerability in the Oracle MySQL Server Optimizer component affecting versions 8.0.26 and prior. A low-privileged attacker with network access via multiple protocols can exploit this flaw to cause a hang or repeatable crash, resulting in a complete denial of service. Successful exploitation also allows unauthorized update, insert, or delete access to a subset of MySQL Server data. The vulnerability impacts Oracle MySQL directly and downstream products from NetApp and Fedora that bundle the affected MySQL versions. Oracle addressed the issue in the October 2021 Critical Patch Update.

Critical Impact
Authenticated attackers can crash MySQL Server and tamper with accessible data over the network, disrupting database-backed applications.

Affected Products

Oracle MySQL Server 8.0.26 and prior
NetApp OnCommand Insight and SnapCenter
Fedora 33, 34, and 35

Discovery Timeline

2021-10-20 - CVE-2021-35610 published to NVD
2021-10-20 - Oracle releases October 2021 Critical Patch Update addressing the issue
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-35610

Vulnerability Analysis

The flaw resides in the MySQL Server Optimizer component, which is responsible for generating query execution plans. An authenticated attacker submitting crafted SQL workloads can trigger conditions that hang the server or produce a repeatable crash, denying service to all database clients. The same code path also permits unauthorized write operations affecting integrity of some accessible data. Exploitation requires only low privileges, such as a standard MySQL user account, and can be reached over any supported MySQL network protocol. NVD did not assign a specific CWE classification, indicating the root cause was not publicly enumerated by Oracle.

Root Cause

The root cause is an input handling defect within the query optimizer. Specific query constructs trigger an error path that fails to validate state correctly, leading to server-wide instability and unintended data modification side effects. Oracle's advisory does not disclose the exact optimization routine affected, consistent with its standard Critical Patch Update disclosure policy.

Attack Vector

Exploitation occurs over the network using any MySQL-supported protocol such as the classic MySQL protocol or MySQL X Protocol. The attacker must hold valid credentials with at least basic query privileges on the target database. No user interaction is required, and the attack complexity is low. Repeated execution of the malicious query results in a complete denial of service of the MySQL Server process.

No verified public proof-of-concept code is available. See the Oracle Security Alert for vendor-provided technical context.

Detection Methods for CVE-2021-35610

Indicators of Compromise

Repeated mysqld process crashes or restarts logged in error.log without a clear administrative cause
Sudden spikes of long-running or hanging queries originating from low-privileged accounts
Unexpected UPDATE, INSERT, or DELETE operations in the MySQL general or binary log from accounts that normally perform read-only activity

Detection Strategies

Query the performance_schema and information_schema.processlist for queries exceeding normal execution thresholds and correlate with user accounts
Enable the MySQL audit plugin to record query patterns, authentication source IPs, and statement types per user
Compare installed MySQL version against 8.0.27 or later to identify hosts still exposed to the vulnerability

Monitoring Recommendations

Forward MySQL error, slow query, and audit logs to a centralized SIEM or data lake for correlation with authentication events
Alert on mysqld service restarts and crash dumps within short time windows
Track network connections to MySQL ports (default 3306 and 33060) from unexpected sources or applications

How to Mitigate CVE-2021-35610

Immediate Actions Required

Apply the Oracle October 2021 Critical Patch Update to upgrade MySQL Server to a fixed release beyond 8.0.26
Update NetApp OnCommand Insight and SnapCenter to versions listed in the NetApp Security Advisory
Update Fedora 33, 34, and 35 hosts using the published dnf package updates from the Fedora package announcements
Review and reduce MySQL account privileges, removing unnecessary network-accessible accounts

Patch Information

Oracle resolved CVE-2021-35610 in the Oracle Critical Patch Update Advisory - October 2021. Fedora published fixed packages through its package-announce mailing list. NetApp shipped corresponding fixes in updated releases of OnCommand Insight and SnapCenter.

Workarounds

Restrict network access to MySQL ports using host firewalls or security groups so only application servers can reach the database
Require TLS-authenticated connections and rotate credentials for any low-privileged accounts that are no longer needed
Enforce per-user query resource limits using MAX_QUERIES_PER_HOUR, MAX_UPDATES_PER_HOUR, and MAX_USER_CONNECTIONS to limit abuse

bash

# Configuration example - restrict resource consumption per low-privileged account
mysql -u root -p -e "ALTER USER 'appuser'@'%' \
  WITH MAX_QUERIES_PER_HOUR 1000 \
       MAX_UPDATES_PER_HOUR 200 \
       MAX_USER_CONNECTIONS 10;"

# Verify the running MySQL version is patched (8.0.27 or later)
mysql -u root -p -e "SELECT VERSION();"