CVE-2023-21912: Oracle MySQL Server DoS Vulnerability

CVE-2023-21912 Overview

CVE-2023-21912 is a denial-of-service vulnerability in the Oracle MySQL Server Server: Security: Privileges component. The flaw affects MySQL Server versions 5.7.41 and prior, and 8.0.30 and prior. An unauthenticated remote attacker can exploit the issue over multiple network protocols without user interaction. Successful exploitation causes the MySQL Server process to hang or crash repeatedly, producing a complete denial of service. Oracle addressed the issue in the April 2023 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can trigger a complete denial of service against MySQL Server, halting database availability for downstream applications.

Affected Products

Oracle MySQL Server 5.7.41 and prior
Oracle MySQL Server 8.0.30 and prior
NetApp products bundling affected MySQL versions (per NetApp advisory NTAP-20230427-0007)

Discovery Timeline

2023-04-18 - CVE-2023-21912 published to the National Vulnerability Database (NVD)
2023-04-18 - Oracle releases security patch via the April 2023 Critical Patch Update
2023-04-27 - NetApp publishes downstream advisory NTAP-20230427-0007
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-21912

Vulnerability Analysis

The vulnerability resides in the privileges subsystem of the MySQL Server component responsible for security enforcement. According to the Oracle advisory, an attacker reaches the vulnerable code path over the network without authentication. The flaw allows the attacker to send crafted protocol traffic that drives the server into a hang condition or a repeatable crash. The impact is limited to availability, with no confidentiality or integrity exposure reported. NVD assigns CWE classification NVD-CWE-noinfo because Oracle does not publish low-level technical details for Critical Patch Update entries.

Root Cause

Oracle does not disclose the precise root cause for CVE-2023-21912. The affected component is Server: Security: Privileges, indicating the defect involves logic that evaluates user privileges during connection handling or statement authorization. Improper input handling in this code path allows attacker-supplied data to push the server into an unrecoverable state.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. The vulnerability is reachable through multiple MySQL Server protocols, which includes the standard MySQL wire protocol on TCP port 3306 and additional protocol handlers exposed by the server. An attacker who can establish a TCP connection to the database instance can deliver the malicious traffic. Internet-exposed MySQL instances and instances reachable from compromised internal hosts are both at risk.

No public proof-of-concept or exploit code is available at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details beyond the Oracle advisory are not published. Refer to the Oracle Security Alert CPUAPR2023 for vendor-supplied information.

Detection Methods for CVE-2023-21912

Indicators of Compromise

Repeated, unexpected restarts of the mysqld process recorded in the MySQL error log or systemd journal.
Connection floods or malformed handshake packets on TCP port 3306 from untrusted sources.
Sustained client-side errors such as Lost connection to MySQL server during query or MySQL server has gone away from applications targeting an affected instance.

Detection Strategies

Inventory database hosts and identify any MySQL Server instance running 5.7.41 or earlier, or 8.0.30 or earlier, by querying SELECT VERSION();.
Monitor network traffic to MySQL listener ports for anomalous protocol activity, especially repeated handshake attempts from external sources.
Correlate MySQL crash events with preceding network connections to identify probing behavior consistent with denial-of-service attempts.

Monitoring Recommendations

Forward MySQL error logs and audit logs to a centralized analytics platform for crash and restart correlation.
Alert on mysqld process exit codes and abnormal restart frequency thresholds via host telemetry.
Track database availability metrics and connection error rates from application-tier monitoring to identify service disruption early.

How to Mitigate CVE-2023-21912

Immediate Actions Required

Apply the Oracle April 2023 Critical Patch Update to all affected MySQL Server installations.
Restrict network exposure of MySQL listener ports to trusted application subnets using host or network firewalls.
Audit downstream products that bundle MySQL, including NetApp appliances, and apply vendor-supplied updates.

Patch Information

Oracle released fixes for CVE-2023-21912 in the April 2023 Critical Patch Update. Upgrade MySQL Server to a version newer than 5.7.41 for the 5.7 branch, or newer than 8.0.30 for the 8.0 branch. Patch details and version mappings are documented in the Oracle Security Alert CPUAPR2023. For NetApp products containing affected MySQL components, follow guidance in NetApp Security Advisory NTAP-20230427-0007.

Workarounds

Place MySQL Server behind a network access control list that permits only authenticated application hosts.
Bind MySQL to internal interfaces by setting bind-address to a non-public address in my.cnf where external access is unnecessary.
Enforce connection rate limiting at the network layer to slow denial-of-service probes against the database listener.

bash

# Configuration example: restrict MySQL bind address and limit connections
# /etc/mysql/my.cnf
[mysqld]
bind-address = 10.0.0.10
max_connections = 200
max_connect_errors = 50

# Verify installed version after patching
mysql -u root -p -e "SELECT VERSION();"