PT-2022-4773 · Mariadb+9 · Mariadb+10

Published 2021-08-13 · Updated 2025-06-10 · CVE-2021-46663

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MariaDB versions 10.5.13 and earlier

Description The issue is related to errors in resource release in the ha maria::extra component of MariaDB, which can cause an application crash via certain SELECT statements. This can lead to a denial of service.

Recommendations For MariaDB versions 10.5.13 and earlier, update to a version later than 10.5.13 to resolve the issue. As a temporary workaround, consider restricting the use of certain SELECT statements that may trigger the ha maria::extra application crash until a patch is available.

Exploit

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

ALSA-2022:5826

ALSA-2022:5948

ALSA-2022:6443

ALT-PU-2022-2360

ALT-PU-2022-2446

ALT-PU-2023-1583

ALT-PU-2023-6462

AZL-8407

BDU:2022-05710

BIT-MARIADB-2021-46663

BIT-MARIADB-MIN-2021-46663

BIT-MYSQL-CLIENT-2021-46663

CESA-2022_5826

CESA-2022_6443

CVE-2021-46663

MGASA-2022-0070

OESA-2022-1587

OPENSUSE-SU-2022:0731-1

OPENSUSE-SU-2022_0725-1

OPENSUSE-SU-2022_0726-1

OPENSUSE-SU-2022_0731-1

OPENSUSE-SU-2022_0731-2

OPENSUSE-SU-2022_2561-1

OPENSUSE-SU-2024:11867-1

RHSA-2022:5759

RHSA-2022:5826

RHSA-2022:5948

RHSA-2022:6306

RHSA-2022:6443

RHSA-2022_5826

RHSA-2022_5948

RHSA-2022_6443

RHSA-2023:6821

RLSA-2022:5826

RLSA-2022:5948

RLSA-2022:6443

ROSA-SA-2023-2252

SUSE-RU-2023:3956-1

SUSE-RU-2023:4991-1

SUSE-SU-2022:0725-1

SUSE-SU-2022:0726-1

SUSE-SU-2022:0731-1

SUSE-SU-2022:0731-2

SUSE-SU-2022:0782-1

SUSE-SU-2022:2561-1

USN-5305-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Mariadb

Mariadb Server

Red Hat

Rocky Linux

Suse

Ubuntu

References · 652

• 🔥 https://github.com/drago-96/CVE-2022-0778 · Exploit
• 🔥 https://github.com/Al1ex/CVE-2021-27928 · Exploit
• 🔥 https://github.com/yywing/cve-2022-0778 · Exploit
• 🔥 https://github.com/jkakavas/CVE-2022-0778-POC · Exploit
• 🔥 https://jira.mariadb.org/browse/MDEV-26351 · Exploit
• 🔥❌ https://github.com/GatoGamer1155/CVE-2021-27928 · Exploit, Deleted
• https://ubuntu.com/security/notices/USN-5305-1 · Vendor Advisory
• https://mariadb.com/kb/en/security · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mariadb-min-2021-46663 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-46664 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-46659 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24051 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mysql-client-2021-46663 · Vendor Advisory