CVE-2023-21912: Oracle MySQL Server DoS Vulnerability

CVE-2023-21912 Overview

CVE-2023-21912 is a denial of service vulnerability affecting the MySQL Server product of Oracle MySQL, specifically within the Server: Security: Privileges component. This easily exploitable vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, resulting in the ability to cause a complete denial of service through a hang or frequently repeatable crash.

Critical Impact

Unauthenticated remote attackers can cause complete denial of service to MySQL Server instances, potentially disrupting critical database operations and business continuity.

Affected Products

• Oracle MySQL Server 5.7.41 and prior versions
• Oracle MySQL Server 8.0.30 and prior versions

Discovery Timeline

• April 18, 2023 - CVE-2023-21912 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-21912

Vulnerability Analysis

This vulnerability resides in the Security: Privileges component of MySQL Server. The flaw enables unauthenticated attackers to trigger a denial of service condition without requiring any user interaction or prior authentication. The attack can be launched remotely over the network using multiple protocols supported by MySQL Server.

The vulnerability is categorized as having availability impact only, with no confidentiality or integrity implications. However, the complete availability impact means that successful exploitation results in a total denial of service to the MySQL Server instance.

Root Cause

The vulnerability stems from improper handling within the Security: Privileges component of MySQL Server. While Oracle has not disclosed specific technical details about the root cause, the CWE classification indicates this is a complex vulnerability type that doesn't map to a single well-defined weakness pattern. The issue allows network-accessible requests to trigger conditions that cause the server process to hang or crash repeatedly.

Attack Vector

The attack can be executed remotely by an unauthenticated attacker with network access to the MySQL Server. The exploitation requires no user interaction and can be performed through multiple network protocols supported by MySQL. An attacker could send specially crafted requests to the MySQL Server that trigger the vulnerability in the privileges handling mechanism, causing the server to become unresponsive or crash. Due to the repeatable nature of the crash, attackers can maintain a persistent denial of service condition against targeted MySQL instances.

Detection Methods for CVE-2023-21912

Indicators of Compromise

• Unexpected MySQL Server crashes or service restarts without administrative action
• MySQL error logs showing repeated crashes related to privilege handling operations
• Network traffic from unauthorized sources attempting multiple connection attempts to MySQL ports (typically 3306)
• Increased frequency of MySQL Server process hangs requiring manual intervention

Detection Strategies

• Monitor MySQL Server error logs for crash events and privilege-related errors
• Implement network intrusion detection rules to identify anomalous connection patterns to MySQL services
• Configure database activity monitoring to detect unusual authentication and privilege-related queries
• Deploy SentinelOne Singularity to detect and alert on MySQL Server process anomalies

Monitoring Recommendations

• Enable MySQL Server audit logging to track authentication attempts and privilege operations
• Configure alerting on MySQL service availability and unexpected restarts
• Monitor network traffic to MySQL ports for unusual patterns or high connection rates
• Implement health checks to detect MySQL Server unavailability promptly

How to Mitigate CVE-2023-21912

Immediate Actions Required

• Upgrade MySQL Server to a patched version (8.0.31 or later for 8.0.x branch, 5.7.42 or later for 5.7.x branch)
• Restrict network access to MySQL Server to trusted hosts only using firewall rules
• Enable MySQL Server audit logging to monitor for exploitation attempts
• Implement network segmentation to limit exposure of database servers

Patch Information

Oracle has released security patches addressing this vulnerability as part of the April 2023 Critical Patch Update. Administrators should review the Oracle Security Alert CPUAPR2023 for detailed patch information and upgrade instructions. Additionally, affected NetApp products should be reviewed according to the NetApp Security Advisory NTAP-20230427-0007.

Workarounds

• Implement strict network access controls to limit connectivity to MySQL Server from untrusted networks
• Use a firewall or security groups to restrict access to MySQL ports only from authorized application servers
• Consider deploying a reverse proxy or application-layer gateway to filter malicious requests
• Enable MySQL Server connection limits to reduce the impact of denial of service attempts

# Configuration example - Restrict MySQL network access
# Add to MySQL configuration file (my.cnf)
[mysqld]
bind-address = 127.0.0.1
# Or bind to specific internal network interface
# bind-address = 10.0.0.10

# Limit concurrent connections
max_connections = 100
max_connect_errors = 10