CVE-2021-35576

Vulnerability

In Oracle Database Enterprise Edition Unified Audit component (versions 12.1.0.2, 12.2.0.1, 19c), custom audit policies are not enforced when the database is started in upgrade mode (startup upgrade). Only default audit policies (such as ORA_SECURECONFIG and ORA_LOGON_FAILURES) remain active in this mode, allowing any action on objects covered by custom policies to go unrecorded in the UNIFIED_AUDIT_TRAIL view [1].

Exploitation

An attacker must have high privileges (ALTER DATABASE and STARTUP) with network access via Oracle Net. The attacker executes the following sequence: (1) Shut down the database, (2) Restart it in upgrade mode (startup upgrade), (3) Perform the restricted operation (e.g., SELECT from a table protected by a custom audit policy), (4) Restart the database normally. During upgrade mode, the action is not audited, leaving no trace in the unified audit trail [1].

Impact

Successful exploitation results in unauthorized update, insert, or delete access to some data within the Oracle Database Enterprise Edition Unified Audit component. The CVSS 3.1 base score is 2.7 (Integrity only), meaning the attacker can modify data without affecting confidentiality or availability. The attack does not require user interaction but does require high privileges and network access [description].

Mitigation

Oracle fixed this vulnerability in the October 2021 Critical Patch Update (CPU) [1]. Organizations should apply the latest CPU for their affected Oracle Database versions (12.1.0.2, 12.2.0.1, 19c). There is no known workaround beyond applying the patch. This CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.