PublicDateAtUSN: 2022-02-18 20:15:00 UTC
Candidate: CVE-2022-24052
PublicDate: 2022-02-18 20:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24052
 https://ubuntu.com/security/notices/USN-5305-1
Description:
 MariaDB CONNECT Storage Engine Heap-based Buffer Overflow Privilege
 Escalation Vulnerability. This vulnerability allows local attackers to
 escalate privileges on affected installations of MariaDB. Authentication is
 required to exploit this vulnerability. The specific flaw exists within the
 processing of SQL queries. The issue results from the lack of proper
 validation of the length of user-supplied data prior to copying it to a
 fixed-length heap-based buffer. An attacker can leverage this vulnerability
 to escalate privileges and execute arbitrary code in the context of the
 service account. Was ZDI-CAN-16190.
Ubuntu-Description:
Notes:
Mitigation:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H [7.8 HIGH]


Patches_mariadb-10.0:
upstream_mariadb-10.0: needs-triage
trusty_mariadb-10.0: ignored (out of standard support)
xenial_mariadb-10.0: ignored (out of standard support)

Patches_mariadb-10.1:
upstream_mariadb-10.1: needs-triage
trusty_mariadb-10.1: ignored (out of standard support)
xenial_mariadb-10.1: ignored (out of standard support)
bionic_mariadb-10.1: needs-triage

Patches_mariadb-10.3:
upstream_mariadb-10.3: needs-triage
trusty_mariadb-10.3: ignored (out of standard support)
xenial_mariadb-10.3: ignored (out of standard support)
focal_mariadb-10.3: released (1:10.3.34-0ubuntu0.20.04.1)

Patches_mariadb-10.5:
upstream_mariadb-10.5: needs-triage
trusty_mariadb-10.5: ignored (out of standard support)
xenial_mariadb-10.5: ignored (out of standard support)
impish_mariadb-10.5: released (1:10.5.15-0ubuntu0.21.10.1)

Patches_mariadb-10.6:
upstream_mariadb-10.6: needs-triage
trusty_mariadb-10.6: ignored (out of standard support)
xenial_mariadb-10.6: ignored (out of standard support)
jammy_mariadb-10.6: needs-triage
devel_mariadb-10.6: needs-triage

Patches_mariadb-5.5:
upstream_mariadb-5.5: needs-triage
trusty_mariadb-5.5: ignored (out of standard support)
xenial_mariadb-5.5: ignored (out of standard support)