Cyber Resilience

CVE-2024-57654

HighPublic PoC

Published: 14 January 2025

Published
14 January 2025
Modified
17 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0027 51.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57654 is a high-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Openlinksw Virtuoso. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-57654 is a denial-of-service vulnerability in the qst_vec_get_int64 component of OpenLink Virtuoso OpenSource version 7.2.11. The flaw allows attackers to trigger a DoS condition through specially crafted SQL statements, stemming from CWE-404 (Improper Resource Shutdown or Denial of Service). It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity due to its network accessibility, low complexity, lack of required privileges or user interaction, and significant impact on availability.

Remote, unauthenticated attackers can exploit this vulnerability by sending malicious SQL statements to a vulnerable Virtuoso instance. Successful exploitation disrupts service availability, potentially crashing the server or rendering it unresponsive without affecting confidentiality or integrity.

For mitigation details, refer to the advisory in the GitHub issue at https://github.com/openlink/virtuoso-opensource/issues/1205.

EU & UK References

Vulnerability details

An issue in the qst_vec_get_int64 component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

CWE(s)
CWE-404

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Vulnerability enables remote unauthenticated exploitation of public-facing DB service (T1190) via crafted SQL, directly causing application/system DoS (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-57661Same product: Openlinksw Virtuoso
CVE-2024-57659Same product: Openlinksw Virtuoso
CVE-2024-57642Same product: Openlinksw Virtuoso
CVE-2024-57637Same product: Openlinksw Virtuoso
CVE-2024-57651Same product: Openlinksw Virtuoso
CVE-2024-57641Same product: Openlinksw Virtuoso
CVE-2024-57658Same product: Openlinksw Virtuoso
CVE-2024-57657Same product: Openlinksw Virtuoso
CVE-2024-57663Same product: Openlinksw Virtuoso
CVE-2024-57638Same product: Openlinksw Virtuoso

Affected Assets

openlinksw
virtuoso
7.2.11

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the specific flaw in qst_vec_get_int64 by requiring timely application of vendor patches for Virtuoso v7.2.11.

SC-5 Denial-of-service Protection good match
prevent

Implements denial-of-service protections such as rate limiting and resource quotas to block crafted SQL statements that trigger the DoS condition.

SI-10 Information Input Validation good match
prevent

Validates incoming SQL statements to reject malformed inputs exploiting the qst_vec_get_int64 component and prevent service disruption.

References