CVE-2024-20964: Oracle MySQL Server DoS Vulnerability

CVE-2024-20964 Overview

CVE-2024-20964 is a Denial of Service vulnerability affecting the MySQL Server product of Oracle MySQL, specifically within the Server: Security: Privileges component. This vulnerability allows a low-privileged attacker with network access to cause a complete denial of service condition, resulting in a hang or frequently repeatable crash of the MySQL Server.

Critical Impact

Successful exploitation can result in complete availability loss of the MySQL Server, causing service disruptions that may affect database-dependent applications and business operations.

Affected Products

• Oracle MySQL Server version 8.0.35 and prior
• Oracle MySQL Server version 8.2.0 and prior

Discovery Timeline

• February 17, 2024 - CVE-2024-20964 published to NVD
• November 4, 2025 - Last updated in NVD database

Technical Details for CVE-2024-20964

Vulnerability Analysis

This vulnerability resides in the privilege management component of Oracle MySQL Server. The flaw enables attackers who possess valid but low-privilege credentials to trigger a denial of service condition through network-based attacks. While the vulnerability requires authentication and has high attack complexity, successful exploitation completely disrupts database availability without impacting confidentiality or integrity of stored data.

The vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption), indicating that the underlying issue involves improper handling of resource allocation or consumption within the privileges component. An attacker can leverage this weakness to exhaust server resources or trigger crash conditions.

Root Cause

The root cause stems from improper resource management within the Server: Security: Privileges component of MySQL Server. When certain privilege-related operations are performed under specific conditions, the server fails to properly handle resource constraints, leading to either a hang state or a crash condition. The exact technical mechanism involves uncontrolled resource consumption that can be triggered by authenticated users.

Attack Vector

The attack requires network access to the MySQL Server and can be executed via multiple protocols. An attacker must possess low-privilege credentials to authenticate to the server before attempting exploitation. The attack complexity is classified as high, meaning specific conditions must be met for successful exploitation:

1. Attacker establishes a network connection to the vulnerable MySQL Server
2. Attacker authenticates using low-privilege credentials
3. Attacker executes specific operations targeting the privilege component
4. The server enters a hang state or crashes, denying service to legitimate users

The vulnerability does not require user interaction and the scope remains unchanged, meaning the impact is contained to the MySQL Server component itself.

Detection Methods for CVE-2024-20964

Indicators of Compromise

• Unexpected MySQL Server crashes or service restarts without apparent cause
• Repeated authentication attempts from unusual source addresses followed by server instability
• MySQL error logs showing privilege-related errors preceding crash events
• Abnormal resource consumption patterns in the MySQL Server process

Detection Strategies

• Monitor MySQL Server error logs for crash dumps referencing the privileges component
• Implement network-level monitoring to detect unusual patterns of authenticated connections
• Configure MySQL audit logging to track privilege-related operations from low-privilege users
• Deploy database activity monitoring (DAM) solutions to identify anomalous query patterns

Monitoring Recommendations

• Enable MySQL performance schema monitoring to detect resource exhaustion conditions
• Configure alerting for MySQL Server process crashes or unexpected restarts
• Implement connection rate limiting and monitoring for authenticated sessions
• Review MySQL audit logs regularly for privilege escalation attempts or unusual administrative operations

How to Mitigate CVE-2024-20964

Immediate Actions Required

• Upgrade Oracle MySQL Server to the latest patched version beyond 8.0.35 or 8.2.0
• Review and restrict network access to MySQL Server instances to trusted hosts only
• Audit user accounts and remove unnecessary low-privilege accounts that have network access
• Implement connection limits per user to reduce potential impact of exploitation attempts

Patch Information

Oracle has addressed this vulnerability in the January 2024 Critical Patch Update. Administrators should apply the patches available through the Oracle Security Alert January 2024. Additionally, NetApp has released a related advisory for affected products, available at the NetApp Security Advisory NTAP-20240201-0003.

Organizations should prioritize patching MySQL Server instances that are network-accessible, particularly those exposed to less-trusted network segments or users.

Workarounds

• Restrict network access to MySQL Server using firewall rules to limit connections to trusted IP addresses
• Implement strong authentication policies and remove unnecessary user accounts with network access privileges
• Consider deploying MySQL Proxy or similar solutions to add an additional layer of access control
• Enable MySQL Server's connection control plugin to limit connection attempts and detect brute-force activity

# Configuration example - Restrict MySQL network access via firewall
# Allow MySQL connections only from trusted application servers
iptables -A INPUT -p tcp --dport 3306 -s trusted_app_server_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP

# MySQL configuration to limit connections per user
# Add to my.cnf under [mysqld] section
# max_user_connections = 10