PT-2024-29395 · Pingcap · Tidb

R33S3N6 · Published 2024-09-03 · Updated 2025-09-04 · CVE-2024-41434

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions PingCAP TiDB version 8.1.0

Description The issue is related to a buffer overflow via the (*Column).GetDecimal component, which can be exploited to cause a Denial of Service (DoS) by providing a crafted input to the 'RemoveUnnecessaryFirstRow' function. This function checks the expression between 'Agg' and 'GroupBy' but does not verify the return type. It is worth noting that PingCAP disputes the severity of this issue, considering it a complex query bug rather than a DoS vulnerability.

Recommendations For PingCAP TiDB version 8.1.0, as a temporary workaround, consider restricting the use of the (*Column).GetDecimal component until a patch is available. Additionally, avoid using crafted inputs to the 'RemoveUnnecessaryFirstRow' function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-41434

Affected Products

Tidb

References · 10

• 🔥 https://github.com/pingcap/tidb/issues/53733 · Exploit
• https://osv.dev/vulnerability/CVE-2024-41434 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41434 · Security Note
• https://t.me/cvenotify/93176 · Telegram Post
• https://twitter.com/CVEnew/status/1831067652913025263 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1831098637553635402 · Twitter Post
• https://t.me/cveNotify/134295 · Telegram Post
• https://gist.github.com/ycybfhb/4aa6809695b9e8a1cd1429e597c17517 · Note
• https://t.me/cvedetector/4720 · Telegram Post
• https://t.me/cvenotify/96058 · Telegram Post