CVE-2022-31621

Name	CVE-2022-31621
Description	MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occurs (stream_ctxt->dest_file == NULL) while executing the method xbstream_open, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mariadb-10.5 (PTS)	bullseye	1:10.5.23-0+deb11u1	fixed
	bullseye (security)	1:10.5.26-0+deb11u2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
mariadb-10.1	source	(unstable)	(unfixed)
mariadb-10.3	source	buster	1:10.3.34-0+deb10u1
mariadb-10.3	source	(unstable)	(unfixed)
mariadb-10.5	source	bullseye	1:10.5.15-0+deb11u1
mariadb-10.5	source	(unstable)	(unfixed)
mariadb-10.6	source	(unstable)	1:10.6.5-1

https://jira.mariadb.org/browse/MDEV-26574
https://github.com/MariaDB/server/commit/b1351c15946349f9daa7e5297fb2ac6f3139e4a8 (mariadb-10.2.41)