CVE-2024-20972: Oracle MySQL Server DOS Vulnerability

CVE-2024-20972 Overview

CVE-2024-20972 is a denial of service vulnerability in the Oracle MySQL Server Optimizer component. The flaw affects MySQL Server versions 8.0.35 and prior, and 8.2.0 and prior. An authenticated attacker with high privileges and network access can exploit the issue over multiple protocols to trigger a hang or repeatable crash of the database service. Oracle addressed the issue in the January 2024 Critical Patch Update. The vulnerability is categorized under [CWE-400] Uncontrolled Resource Consumption and is exploitable without user interaction.

Critical Impact
Successful exploitation results in a complete denial of service against the MySQL Server, causing application-tier outages for any workload dependent on the database.

Affected Products

Oracle MySQL Server 8.0.35 and prior
Oracle MySQL Server 8.1.0
Oracle MySQL Server 8.2.0 and prior

Discovery Timeline

2024-02-17 - CVE-2024-20972 published to NVD
2024-01 - Oracle releases fix in January 2024 Critical Patch Update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20972

Vulnerability Analysis

The vulnerability resides in the Server: Optimizer component of Oracle MySQL Server. The Optimizer is responsible for parsing SQL statements, generating execution plans, and selecting the most efficient path to retrieve query results. A defect in this component allows an authenticated attacker to submit crafted queries that consume resources uncontrollably or drive the server into a state that halts query processing.

Exploitation requires high privileges on the target database, meaning the attacker must already hold an account with elevated permissions such as those granted through administrative roles. Network access is required, and the flaw is reachable across multiple MySQL protocols. No user interaction is needed to trigger the condition.

The outcome is a hang or a frequently repeatable crash of the MySQL Server process, producing a complete denial of service. Confidentiality and integrity are not affected; only availability of the database service is impacted.

Root Cause

The root cause is tracked as [CWE-400] Uncontrolled Resource Consumption inside the query optimizer logic. Specific crafted query structures cause the optimizer to enter a state where it fails to release resources or process the plan to completion, halting or crashing the server process.

Attack Vector

The attack vector is a network-accessible MySQL protocol endpoint. An attacker authenticated with a high-privilege account submits crafted SQL that reaches the vulnerable optimizer code path. Because the crash is repeatable, an attacker can hold the database in a degraded state by resubmitting the query after each restart.

No verified public exploit code or proof-of-concept has been published for this issue. Refer to the Oracle Critical Patch Update - January 2024 advisory and the NetApp Security Advisory NTAP-20240201-0003 for vendor technical context.

Detection Methods for CVE-2024-20972

Indicators of Compromise

Unexpected MySQL Server process crashes or restarts recorded in mysqld.log or systemd journal entries for the mysqld service.
Repeated ERROR 2013 (HY000): Lost connection to MySQL server during query client errors originating from the same authenticated session.
Sudden growth in MySQL error log entries referencing optimizer assertions or signal handler stack traces.

Detection Strategies

Correlate MySQL crash events with the executing session, source host, and last-executed statement from the general query log or Performance Schema events_statements_history.
Alert on privileged database accounts issuing anomalous or unusually complex queries outside of maintenance windows.
Monitor MySQL process uptime and generate alerts when the service restarts more than once within a short time window.

Monitoring Recommendations

Enable the MySQL audit plugin to capture statements issued by high-privilege accounts and forward logs to a central analysis platform.
Track MySQL Server availability with health checks that measure query response latency and process uptime.
Review authentication logs for high-privileged logins from unexpected source addresses or service accounts.

How to Mitigate CVE-2024-20972

Immediate Actions Required

Apply the Oracle January 2024 Critical Patch Update to all MySQL Server 8.0.x and 8.2.x deployments.
Inventory MySQL Server instances and confirm running versions with SELECT VERSION(); to identify vulnerable hosts.
Audit accounts holding high-privilege roles such as SUPER, PROCESS, or DBA and revoke privileges that are not operationally required.

Patch Information

Oracle addressed CVE-2024-20972 in the Oracle Critical Patch Update - January 2024. Upgrade MySQL Server to a version released after 8.0.35 or 8.2.0 that includes the January 2024 CPU fixes. NetApp customers running affected ONTAP tools should consult the NetApp Security Advisory NTAP-20240201-0003 for product-specific guidance.

Workarounds

Restrict network access to MySQL Server ports (default 3306) using firewall rules that permit only trusted application hosts.
Reduce the number of accounts granted high-privilege roles and enforce strong authentication on all administrative accounts.
Deploy a database proxy or connection pooler that can rate-limit statements from a single session to slow abuse of the vulnerable code path.

bash

# Configuration example: revoke unnecessary high privileges and restrict network exposure
mysql> REVOKE SUPER, PROCESS ON *.* FROM 'app_user'@'%';
mysql> FLUSH PRIVILEGES;

# Restrict MySQL to trusted subnets at the OS level
iptables -A INPUT -p tcp --dport 3306 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP