Read the docs
TI-2022-08012 Aliases CVE-2022-24052GHSA-pfvf-3927-r9fx

Heap-based buffer overflow in MariaDB

Priority LOW 35CWE-122Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 8 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16190.

Why it matters now

EPSS 0.00694 53rd percentileScored 2026-11-07
Fix Partial Red Hat: 6 advisoriesRed Hat: 8 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MariaDBMariaDB10.6.5—No fix listedCNA
  • MariaDB VendorMariaDB Affected 10.6.5 Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*10.2.0 to before 10.2.42; 10.3.0 to before 10.3.33; 10.4.0 to before 10.4.23; 10.5.0 to before 10.5.14; 10.6.0 to before 10.6.6; 10.7.0 to before 10.7.2VulnerableMariaDB
cpe:2.3:a:mariadb:mariadb:10.8.0:*:*:*:*:*:*:*10.8.0VulnerableMariaDB
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
  • cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:* Versions 10.2.0 to before 10.2.42; 10.3.0 to before 10.3.33; 10.4.0 to before 10.4.23; 10.5.0 to before 10.5.14; 10.6.0 to before 10.6.6; 10.7.0 to before 10.7.2 Vulnerable ·MariaDB
  • cpe:2.3:a:mariadb:mariadb:10.8.0:*:*:*:*:*:*:* Versions 10.8.0 Vulnerable ·MariaDB
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject

Remediation

Red Hat 6 advisories

  • RHSA-2023:6821 Released 2023-11-08 · Red Hat rating Important
    mariadb:10.5 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.src::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5, galera-26.4.14-1.module+el8.4.0+20291+fd32d29c.src::mariadb:10.5 +16
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.aarch64::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.ppc64le::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.s390x::mariadb:10.5 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.src::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.x86_64::mariadb:10.5, galera-26.4.14-1.module+el8.4.0+20291+fd32d29c.src::mariadb:10.5 +16
  • RHSA-2022:6443 Released 2022-09-13 · Red Hat rating Moderate
    mariadb:10.3 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) Judy-1.0.5-18.module+el8+2765+cfa4f87b.aarch64::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.ppc64le::mariadb:10.3, Judy-1.0.5-18.module+el8+2765+cfa4f87b.s390x::mariadb:10.3 +47
  • RHSA-2022:6306 Released 2022-09-01 · Red Hat rating Moderate
    rh-mariadb103-galera and rh-mariadb103-mariadb security and bug fix update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-mariadb103-mariadb-3:10.3.35-1.el7, rh-mariadb103-mariadb-backup-3:10.3.35-1.el7, rh-mariadb103-mariadb-backup-syspaths-3:10.3.35-1.el7 +16
    • Red Hat Software Collections for RHEL(v. 7) rh-mariadb103-mariadb-3:10.3.35-1.el7, rh-mariadb103-mariadb-backup-3:10.3.35-1.el7, rh-mariadb103-mariadb-backup-syspaths-3:10.3.35-1.el7 +16
Show 3 more Red Hat advisories
  • RHSA-2022:5948 Released 2022-08-09 · Red Hat rating Moderate
    galera, mariadb, and mysql-selinux security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder (v. 9) mariadb-devel-3:10.5.16-2.el9_0, mariadb-embedded-devel-3:10.5.16-2.el9_0, mariadb-test-3:10.5.16-2.el9_0
    • Red Hat Enterprise Linux AppStream (v. 9) galera-26.4.11-1.el9_0, mariadb-3:10.5.16-2.el9_0, mariadb-backup-3:10.5.16-2.el9_0 +10
  • RHSA-2022:5826 Released 2022-08-02 · Red Hat rating Moderate
    mariadb:10.5 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.aarch64::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.ppc64le::mariadb:10.5, Judy-1.0.5-18.module+el8.4.0+9031+9abc7af9.s390x::mariadb:10.5 +47
  • RHSA-2022:5759 Released 2022-07-28 · Red Hat rating Moderate
    rh-mariadb105-galera and rh-mariadb105-mariadb security and bugfix update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-mariadb105-mariadb-3:10.5.16-2.el7, rh-mariadb105-mariadb-backup-3:10.5.16-2.el7, rh-mariadb105-mariadb-backup-syspaths-3:10.5.16-2.el7 +18
    • Red Hat Software Collections for RHEL(v. 7) rh-mariadb105-mariadb-3:10.5.16-2.el7, rh-mariadb105-mariadb-backup-3:10.5.16-2.el7, rh-mariadb105-mariadb-backup-syspaths-3:10.5.16-2.el7 +18

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat CodeReady Linux Builder (v. 9)Fixed RHSA-2022:5948
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:5826, RHSA-2022:6443
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:5948
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2023:6821
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2023:6821
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2023:6821
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2022:5759, RHSA-2022:6306
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2022:5759, RHSA-2022:6306
Not affected: 4 products
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat JBoss Core Services
  • Red Hat Software Collections for RHEL Workstation(v. 7)
  • Red Hat Software Collections for RHEL(v. 7)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24052
  2. 2026-10-03 Alias added: GHSA-pfvf-3927-r9fx

References

Patch 1

Advisory 5

  • TI-2023-11776 MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via… CVSS 3.1CRITICAL 9.8
  • TI-2016-05707 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB… CVSS 3.0CRITICAL 9.8
  • TI-2022-00687 Infinite loop in BN_mod_sqrt() reachable when parsing certificates CVSS 3.1HIGH 7.5
  • TI-2014-00217 OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly… CVSS 3.1HIGH 7.4
  • TI-2014-00188 The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0… CVSS 2.0MEDIUM 6.8
  • TI-2018-15259 zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if… CVSS 3.1HIGH 7.5
See all 429 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences