CVE-2022-24050: MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on ...

Description

MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16207.

Metrics

CVSS 3.1

7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.60%

44.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-416

Affected Software

Vendor	Product	Versions
Mariadb	Mariadb	>= 10.2.0, < 10.2.42
Mariadb	Mariadb	>= 10.3.0, < 10.3.33
Mariadb	Mariadb	>= 10.4.0, < 10.4.23
Mariadb	Mariadb	>= 10.5.0, < 10.5.14
Mariadb	Mariadb	>= 10.6.0, < 10.6.6
Mariadb	Mariadb	>= 10.7.0, < 10.7.2
Mariadb	Mariadb	10.8.0
Fedoraproject	Fedora	34
Fedoraproject	Fedora	35
Fedoraproject	Fedora	36

References

Timeline

Published: Feb 18, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-24050?

MariaDB CONNECT Storage Engine Use-After-Free Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16207.

How severe is CVE-2022-24050?

CVE-2022-24050 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.60% probability of exploitation in the next 30 days.

How do I fix CVE-2022-24050?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.