CVE-2024-57623
Published: 14 January 2025
Summary
CVE-2024-57623 is a high-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Monetdb Monetdb. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Deeper analysis
CVE-2024-57623 affects the HEAP_malloc component in MonetDB Server version 11.49.1. The vulnerability enables attackers to trigger a Denial of Service (DoS) condition by sending crafted SQL statements. It is associated with CWE-404 (Improper Resource Shutdown or Release) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to availability impact.
The attack requires only network access with low complexity and no privileges, authentication, or user interaction. Remote, unauthenticated attackers can exploit it by crafting malicious SQL statements that cause resource exhaustion or improper memory handling in the HEAP_malloc function, leading to service disruption without compromising confidentiality or integrity.
Mitigation details are available in the referenced GitHub issue at https://github.com/MonetDB/MonetDB/issues/7415, which documents the vulnerability in MonetDB's repository.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53655
Vulnerability details
An issue in the HEAP_malloc component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote exploitation of public-facing DB server via crafted SQL input directly enables initial access (T1190) and causes application DoS through resource exhaustion (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely flaw remediation through vendor patches directly addresses and eliminates the specific heap malloc vulnerability exploited by crafted SQL statements.
Denial-of-service protection mechanisms prevent resource exhaustion attacks triggered by unauthenticated remote crafted SQL inputs.
Ensures resource availability by protecting against unauthorized depletion due to improper memory handling in the HEAP_malloc component.