PT-2022-3331 · Mariadb+8 · Mariadb+9

Yaoguang · Published 2021-08-19 · Updated 2025-06-10 · CVE-2022-32089

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MariaDB versions 10.5 through 10.7

Description The issue is related to a segmentation fault in the st select lex unit::exclude level component of the MariaDB database management system. This can potentially allow a remote attacker to impact the availability of protected information due to a buffer overflow in memory.

Recommendations For MariaDB versions 10.5 through 10.7, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the st select lex unit::exclude level component until a patch is available.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALSA-2023:5683

ALSA-2023:5684

ALT-PU-2022-2436

ALT-PU-2022-2446

ALT-PU-2023-1583

ALT-PU-2023-6462

BDU:2022-04079

BIT-MARIADB-2022-32089

BIT-MARIADB-MIN-2022-32089

BIT-MYSQL-CLIENT-2022-32089

CESA-2023_5683

CVE-2022-32089

MGASA-2022-0314

OPENSUSE-SU-2022_3159-1

OPENSUSE-SU-2022_3391-1

OPENSUSE-SU-2024:12360-1

RHSA-2023:5683

RHSA-2023:5684

RHSA-2023:6821

RHSA-2023:6822

RHSA-2023:6883

RHSA-2023:7633

RHSA-2023_5683

RHSA-2023_5684

RLSA-2023:5683

ROSA-SA-2023-2255

SUSE-RU-2023:3956-1

SUSE-RU-2023:4991-1

SUSE-SU-2022:3159-1

SUSE-SU-2022:3225-1

SUSE-SU-2022:3391-1

USN-5739-1

USN-5739-2

Affected Products

Alt Linux

Almalinux

Centos

Linuxmint

Mariadb

Mariadb Server

Red Hat

Rocky Linux

Suse

Ubuntu

References · 537

• 🔥 https://github.com/drago-96/CVE-2022-0778 · Exploit
• 🔥 https://github.com/yywing/cve-2022-0778 · Exploit
• 🔥 https://github.com/jkakavas/CVE-2022-0778-POC · Exploit
• 🔥 https://jira.mariadb.org/browse/MDEV-26410 · Exploit
• https://ubuntu.com/security/CVE-2022-32088 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12360-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-32083 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5739-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-27457 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-25032 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-5683.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5739-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-27447 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-32084 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-5684.html · Vendor Advisory