CVE-2022-27386: 
MariaDB Server vulnerability analysis and mitigation

MariaDB Server v10.7 and below contains a segmentation fault vulnerability in the component sql/sql_class.cc. The vulnerability was discovered and reported on March 21, 2022, as identified by CVE-2022-27386 (CVE Mitre).

The vulnerability manifests as a segmentation fault in the Query_arena::set_query_arena function within the sql/sql_class.cc component. The issue occurs during specific SQL query operations involving DEFAULT values and hex functions. The vulnerability has been assigned a CVSS v3.1 score of 7.5 (HIGH) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NetApp Advisory).

When successfully exploited, this vulnerability can lead to a Denial of Service (DoS) condition in the affected MariaDB server installations. The segmentation fault can cause the database server to crash, potentially disrupting database operations and service availability (NetApp Advisory).

The vulnerability can be triggered through specific SQL queries involving DEFAULT values and hex functions. A proof of concept exists that demonstrates the segmentation fault using a series of SQL commands involving table creation and SELECT statements with specific conditions (MariaDB Jira).

The vulnerability has been addressed in subsequent MariaDB releases. Users are advised to upgrade their MariaDB installations to versions newer than 10.7. For Debian 10 (buster) users, the fix is available in version 1:10.3.36-0+deb10u1 (Debian LTS).