CVE-2022-24048: MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate p...

Description

MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16191.

Metrics

CVSS 3.1

7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.65%

46.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-121

Affected Software

Vendor	Product	Versions
Mariadb	Mariadb	>= 10.2.0, < 10.2.42
Mariadb	Mariadb	>= 10.3.0, < 10.3.33
Mariadb	Mariadb	>= 10.4.0, < 10.4.23
Mariadb	Mariadb	>= 10.5.0, < 10.5.14
Mariadb	Mariadb	>= 10.6.0, < 10.6.6
Mariadb	Mariadb	>= 10.7.0, < 10.7.2
Mariadb	Mariadb	10.8.0
Fedoraproject	Fedora	34
Fedoraproject	Fedora	35
Fedoraproject	Fedora	36

References

Timeline

Published: Feb 18, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-24048?

MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16191.

How severe is CVE-2022-24048?

CVE-2022-24048 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.65% probability of exploitation in the next 30 days.

How do I fix CVE-2022-24048?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.