CVE-2022-38791 — Improper Locking in Mariadb

CWE-667 — Improper Locking7 documents7 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 89.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MariadbFedoraproject Fedora
Timeline
PublishedAug 27
Latest updateAug 28

Description

In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a deadlock.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages1 packages

▶NVDmariadb/mariadb10.3.0 — 10.3.36+6

Also affects: Fedora 35, 36, 37

🔴Vulnerability Details

3
GHSA
GHSA-v65w-qwp3-hm34: In MariaDB before 10↗2022-08-28
▶
CVEList
CVE-2022-38791: In MariaDB before 10↗2022-08-27
▶
OSV
CVE-2022-38791: In MariaDB before 10↗2022-08-27
▶

📋Vendor Advisories

3
Microsoft
In MariaDB before 10.9.2 compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure which allows local users to trigger a deadlock.↗2022-08-09
▶
Red Hat
mariadb: compress_write() fails to release mutex on failure↗2022-06-01
▶
Debian
CVE-2022-38791: mariadb-10.5 - In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc doe...↗2022
▶