PT-2021-7347 · Mariadb+6 · Mariadb+7

Published 2021-11-08 · Updated 2025-06-10 · CVE-2021-46662

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MariaDB versions prior to 10.5.9

Description The issue is related to errors in resource release in the set var.cc component of the MariaDB database management system. Exploitation of this issue can lead to a denial of service. It is caused by certain uses of an UPDATE statement in conjunction with a nested subquery, which can result in an application crash.

Recommendations For versions prior to 10.5.9, update to a version that contains a fix for this issue to prevent potential crashes due to the exploitation of the set var.cc component vulnerability. As a temporary workaround, consider restricting the use of UPDATE statements with nested subqueries until a patch is available.

Exploit

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

ALSA-2022:1556

ALSA-2022:1557

ALT-PU-2022-2360

ALT-PU-2022-2446

ALT-PU-2023-1583

ALT-PU-2023-6462

AZL-8406

BDU:2022-05752

BIT-MARIADB-2021-46662

BIT-MARIADB-MIN-2021-46662

BIT-MYSQL-CLIENT-2021-46662

CESA-2022_1556

CESA-2022_1557

CVE-2021-46662

OESA-2022-1587

RHSA-2022:1007

RHSA-2022:1010

RHSA-2022:1556

RHSA-2022:1557

RHSA-2022:4818

RHSA-2022_1556

RHSA-2022_1557

RHSA-2023:6821

RLSA-2022:1556

RLSA-2022:1557

ROSA-SA-2023-2252

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Mariadb

Mariadb Server

Red Hat

Rocky Linux

References · 84

• 🔥 https://github.com/drago-96/CVE-2022-0778 · Exploit
• 🔥 https://github.com/Al1ex/CVE-2021-27928 · Exploit
• 🔥 https://github.com/yywing/cve-2022-0778 · Exploit
• 🔥 https://github.com/jkakavas/CVE-2022-0778-POC · Exploit
• 🔥 https://jira.mariadb.org/browse/MDEV-25637 · Exploit
• 🔥❌ https://github.com/GatoGamer1155/CVE-2021-27928 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2021-46667 · Security Note
• https://osv.dev/vulnerability/BIT-mariadb-min-2021-46662 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2022-1557.html · Vendor Advisory
• https://mariadb.com/kb/en/security · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-1557.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46669 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46662 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46659 · Security Note
• https://errata.rockylinux.org/RLSA-2022:1556 · Vendor Advisory