Integer Overflow in Redis Allows Denial of Service and Sandbox Bypass (CVE-2020-14147)
Summary
CVE-2020-14147: An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and a... Affects redis across 3 version ranges.
< 6.0.3-r0
< ce878b6ed5df1a7b3e87a8af2d1262de4c5bb828
< ef764dde1cca2f25d00686673d1bc89448819571
Fixed in 6.0.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redis is an open-source, in-memory data structure store that is commonly used as a database, cache, and message broker. It provides high performance, scalability, and various data structures such as strings, lists, sets, and more. However, a vulnerability in Redis versions before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions. This vulnerability is a regression of CVE-2015-8080.
Vulnerability Detail
The vulnerability (CVE-2020-14147) is an integer overflow in the 'getnum' function in 'lua_struct.c' in Redis. It can be exploited by attackers who have permission to run Lua code in a Redis session. By providing a large number, the attacker triggers a stack-based buffer overflow, leading to memory corruption and a potential application crash. This vulnerability can also be used to bypass sandbox restrictions, allowing the attacker to execute unauthorized actions within the Redis environment.
How To Fix
Minimum fixed version
6.0.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by upgrading Redis to version 6.0.3 or later.
Conclusion
The integer overflow vulnerability in Redis (CVE-2020-14147) can lead to denial of service and sandbox bypass. It is crucial to upgrade Redis to version 6.0.3 or later to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for redis →
FAQ
Redis is an open-source, in-memory data structure store that is commonly used as a database, cache, and message broker.
The vulnerability allows attackers to cause a denial of service, leading to memory corruption and potential application crashes. It can also be used to bypass sandbox restrictions, enabling unauthorized actions within the Redis environment.
To fix this vulnerability, upgrade Redis to version 6.0.3 or later.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is necessary.
Yes, this vulnerability (CVE-2020-14147) is a regression of CVE-2015-8080.
Related vulnerabilities
Recent vulnerabilities recorded for redis.
