CVE-2022-27376 : MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in

MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL statements.

Published 2022-04-12 20:15:08

Updated 2022-09-29 16:28:39

Source MITRE

View at NVD, CVE.org

Vulnerability category: Memory Corruption

Products affected by CVE-2022-27376

Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Mariadb » Mariadb
Versions from including (>=) 10.7.0 and before (<) 10.7.4
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Matching versions
Mariadb » Mariadb
Versions from including (>=) 10.6.0 and before (<) 10.6.8
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Matching versions
Mariadb » Mariadb
Versions from including (>=) 10.4.0 and before (<) 10.4.25
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Matching versions
Mariadb » Mariadb
Versions from including (>=) 10.5.0 and before (<) 10.5.16
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Matching versions
Mariadb » Mariadb
Versions from including (>=) 10.3.0 and before (<) 10.3.35
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-27376

EPSS FAQ

0.15%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 52 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-27376

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2022-27376

CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-27376

https://security.netapp.com/advisory/ntap-20220519-0007/

CVE-2022-27376 MariaDB Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html

[SECURITY] [DLA 3114-1] mariadb-10.3 security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://jira.mariadb.org/browse/MDEV-26354

[MDEV-26354] MariaDB server crash in Field::set_default - ASAN use after free in Item_args::walk_arg - Jira
Exploit;Issue Tracking;Vendor Advisory

Jump to

Vulnerability Details : CVE-2022-27376

Products affected by CVE-2022-27376

Exploit prediction scoring system (EPSS) score for CVE-2022-27376

CVSS scores for CVE-2022-27376

CWE ids for CVE-2022-27376

References for CVE-2022-27376