CVE-2023-22053: Oracle MySQL Server DoS Vulnerability

CVE-2023-22053 Overview

CVE-2023-22053 is a vulnerability in the MySQL Server product of Oracle MySQL, specifically within the Client programs component. Affected versions include MySQL Server 5.7.42 and prior, and 8.0.33 and prior. A low-privileged attacker with network access via multiple protocols can exploit this flaw to compromise MySQL Server availability and confidentiality. Successful exploitation results in a hang or repeatable crash of the server, producing a complete denial-of-service condition. Attackers can also obtain unauthorized read access to a subset of MySQL Server data. The vulnerability is also tracked through advisories from Fedora and NetApp, which ship affected MySQL components in downstream products.

Critical Impact
Remote low-privileged attackers can crash MySQL Server (full DoS) and read a subset of server data over the network.

Affected Products

Oracle MySQL Server versions 5.7.42 and prior, and 8.0.33 and prior
Fedora 37, 38, and 39 (MySQL packages)
NetApp Active IQ Unified Manager, OnCommand Insight, OnCommand Workflow Automation, and SnapCenter

Discovery Timeline

2023-07-18 - CVE-2023-22053 published to NVD following Oracle's July 2023 Critical Patch Update
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-22053

Vulnerability Analysis

The flaw resides in the Client programs component of MySQL Server. An authenticated attacker holding low-level privileges can send crafted traffic across one of multiple supported MySQL protocols to trigger the issue. Exploitation requires conditions outside the attacker's direct control, which raises attack complexity, but no user interaction is required. Successful exploitation produces two outcomes: a hang or frequently repeatable crash that fully denies service, and partial unauthorized read access to MySQL Server data. Oracle classifies the issue under the Client programs subcomponent, indicating the defect manifests through client-server protocol interactions rather than within the SQL execution layer. The CWE assignment is NVD-CWE-noinfo because Oracle did not publicly disclose the underlying weakness class.

Root Cause

Oracle's advisory does not disclose the specific code path or weakness type. The vulnerability is categorized within MySQL Server Client programs, which handle protocol parsing and session management for connecting clients. The combination of a denial-of-service outcome and partial information disclosure is consistent with improper handling of malformed or unexpected protocol input.

Attack Vector

The vulnerability is network-exploitable across multiple MySQL protocols. The attacker must hold valid low-privileged credentials on the target MySQL Server. No user interaction is required. The high attack complexity rating indicates the attacker must satisfy specific runtime or configuration conditions to reliably trigger the crash or data exposure.

No public proof-of-concept is available for CVE-2023-22053. Refer to the Oracle Security Alert July 2023 for vendor-confirmed details.

Detection Methods for CVE-2023-22053

Indicators of Compromise

Unexpected MySQL Server (mysqld) process crashes, restarts, or hang states with no corresponding administrative action
Repeated abnormal disconnects or protocol errors logged in MySQL error logs from a single authenticated source
Unusual query or protocol patterns from low-privileged accounts immediately preceding a service crash

Detection Strategies

Inventory MySQL Server instances and compare installed versions against 5.7.42 and 8.0.33 to identify exposed deployments
Monitor mysqld exit codes, core dumps, and systemd or service-manager restart events for crash loops
Correlate MySQL error log entries with authentication logs to identify low-privileged sessions associated with crashes

Monitoring Recommendations

Enable MySQL general query log or audit plugin on sensitive instances to capture session activity preceding crashes
Forward MySQL error logs and host process telemetry to a centralized SIEM for correlation across instances
Alert on repeated MySQL service restarts within short time windows, which indicate exploitation attempts producing a DoS

How to Mitigate CVE-2023-22053

Immediate Actions Required

Apply the fixes from Oracle's July 2023 Critical Patch Update to upgrade MySQL Server beyond 5.7.42 and 8.0.33
Restrict network access to MySQL Server to trusted hosts using firewall rules or bind-address configuration
Audit MySQL user accounts and revoke unused or excessive low-privileged credentials that could be abused for exploitation

Patch Information

Oracle addressed CVE-2023-22053 in the July 2023 Critical Patch Update. Administrators should upgrade MySQL Server to a version later than 5.7.42 or 8.0.33 as documented in the Oracle Security Alert July 2023. Downstream consumers should apply vendor-specific updates: Fedora packages are tracked in the Fedora Package Announcement, and NetApp products are addressed in the NetApp Security Advisory.

Workarounds

Limit MySQL network exposure by binding the service to internal interfaces and enforcing TLS-protected connections
Enforce least-privilege on MySQL accounts and disable unused authentication plugins or client protocols
Implement connection rate limiting and per-user max_user_connections to reduce the impact of repeated crash attempts

bash

# Restrict MySQL bind address and enforce per-user connection limits
# /etc/mysql/my.cnf
[mysqld]
bind-address = 127.0.0.1
max_user_connections = 20
require_secure_transport = ON