CVE-2024-57654
Published: 14 January 2025
Summary
CVE-2024-57654 is a high-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Openlinksw Virtuoso. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the specific flaw in qst_vec_get_int64 by requiring timely application of vendor patches for Virtuoso v7.2.11.
Implements denial-of-service protections such as rate limiting and resource quotas to block crafted SQL statements that trigger the DoS condition.
Validates incoming SQL statements to reject malformed inputs exploiting the qst_vec_get_int64 component and prevent service disruption.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables remote unauthenticated exploitation of public-facing DB service (T1190) via crafted SQL, directly causing application/system DoS (T1499.004).
NVD Description
An issue in the qst_vec_get_int64 component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
Deeper analysisAI
CVE-2024-57654 is a denial-of-service vulnerability in the qst_vec_get_int64 component of OpenLink Virtuoso OpenSource version 7.2.11. The flaw allows attackers to trigger a DoS condition through specially crafted SQL statements, stemming from CWE-404 (Improper Resource Shutdown or Denial of Service). It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity due to its network accessibility, low complexity, lack of required privileges or user interaction, and significant impact on availability.
Remote, unauthenticated attackers can exploit this vulnerability by sending malicious SQL statements to a vulnerable Virtuoso instance. Successful exploitation disrupts service availability, potentially crashing the server or rendering it unresponsive without affecting confidentiality or integrity.
For mitigation details, refer to the advisory in the GitHub issue at https://github.com/openlink/virtuoso-opensource/issues/1205.
Details
- CWE(s)