CVE-2021-35621: 
MySQL vulnerability analysis and mitigation

CVE-2021-35621 is a vulnerability discovered in the MySQL Cluster Data Node component that was disclosed in October 2021. The vulnerability affects MySQL Cluster versions 7.4.33 and prior, allowing high privileged attackers with access to the physical communication segment to potentially exploit buffer overflow issues (ZDI Advisory, Oracle Advisory).

The vulnerability exists within the processing of Data Node jobs in MySQL Cluster. The specific flaw results from the lack of proper validation of the length of user-supplied data prior to copying it to a buffer. The vulnerability has a CVSS v3.1 base score of 6.3 (MEDIUM) with the vector: AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H (ZDI Advisory, NetApp Advisory).

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code in the context of the service account, potentially leading to unauthorized access and modification of data or complete takeover of the MySQL Cluster Data Node (ZDI Advisory).

Oracle has released security patches to address this vulnerability as part of the October 2021 Critical Patch Update. Users are strongly advised to apply these security updates to affected MySQL Cluster installations (Oracle Advisory).