CVE Vulnerabilities

CVE-2022-24051

Use of Externally-Controlled Format String

Published: Feb 18, 2022 | Modified: Nov 21, 2024
CVSS 3.x
7.8
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
4.6 MEDIUM
AV:L/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
7.8 MODERATE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM

MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16193.

Weakness

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Affected Software

Name Vendor Start Version End Version
Mariadb Mariadb 10.2.0 (including) 10.2.42 (excluding)
Mariadb Mariadb 10.3.0 (including) 10.3.33 (excluding)
Mariadb Mariadb 10.4.0 (including) 10.4.23 (excluding)
Mariadb Mariadb 10.5.0 (including) 10.5.14 (excluding)
Mariadb Mariadb 10.6.0 (including) 10.6.6 (excluding)
Mariadb Mariadb 10.7.0 (including) 10.7.2 (excluding)
Mariadb Mariadb 10.8.0 (including) 10.8.0 (including)
Red Hat Enterprise Linux 8 RedHat mariadb:10.5-8060020220614163302.ad008a3a *
Red Hat Enterprise Linux 8 RedHat mariadb:10.3-8060020220715055054.ad008a3a *
Red Hat Enterprise Linux 9 RedHat mariadb-3:10.5.16-2.el9_0 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-mariadb105-mariadb-3:10.5.16-2.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-mariadb103-mariadb-3:10.3.35-1.el7 *
Mariadb-10.0 Ubuntu trusty *
Mariadb-10.0 Ubuntu xenial *
Mariadb-10.1 Ubuntu bionic *
Mariadb-10.1 Ubuntu trusty *
Mariadb-10.1 Ubuntu xenial *
Mariadb-10.3 Ubuntu esm-apps/focal *
Mariadb-10.3 Ubuntu focal *
Mariadb-10.3 Ubuntu trusty *
Mariadb-10.3 Ubuntu xenial *
Mariadb-10.5 Ubuntu impish *
Mariadb-10.5 Ubuntu trusty *
Mariadb-10.5 Ubuntu xenial *
Mariadb-10.6 Ubuntu kinetic *
Mariadb-10.6 Ubuntu lunar *
Mariadb-10.6 Ubuntu trusty *
Mariadb-10.6 Ubuntu xenial *
Mariadb-5.5 Ubuntu trusty *
Mariadb-5.5 Ubuntu xenial *

Potential Mitigations

References