CVE-2022-31624: 
MariaDB Server vulnerability analysis and mitigation

MariaDB Server before version 10.7 was identified with a Denial of Service vulnerability (CVE-2022-31624). The vulnerability was discovered in the plugin/serveraudit/serveraudit.c component, specifically in the logstatementex method, where a lock (lock_bigbuffer) is not properly released, creating a potential security risk (NVD, MITRE).

The vulnerability stems from an improper locking mechanism in the serveraudit.c component. Specifically, the logstatementex method fails to correctly release the lockbigbuffer, which can result in a deadlock condition. The vulnerability has been assigned a CVSS score of 5.5 (MEDIUM) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access is required for exploitation (NetApp).

When successfully exploited, this vulnerability can lead to a Denial of Service (DoS) condition due to the deadlock situation. The impact is primarily focused on system availability, with no direct effect on confidentiality or integrity of the system (NetApp).

The vulnerability was addressed through a code fix that removes the global bigbuffer and modifies the lock handling mechanism in the serveraudit.c file. The fix was implemented in MariaDB Server version 10.7 (GitHub Commit).