Critical Integer Overflow Vulnerability in Redis Package Leading to Potential Remote Code Execution
Summary
ALPINE-CVE-2021-32625: Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. Affects redis versions < 6.0.14-r0. Fixed in 6.0.14-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redis is an open-source, in-memory data structure store, widely utilized as a database, cache, and message broker. It is known for its high performance, flexibility, and support for various data structures such as strings, hashes, lists, sets, and more. However, Redis versions 6.0 and newer are susceptible to a critical integer overflow vulnerability that can be exploited through the STRALGO LCS command.
Vulnerability Detail
The vulnerability arises from an integer overflow bug in Redis, specifically in versions 6.0 and later. This flaw can be exploited using the STRALGO LCS command, leading to heap corruption and potentially allowing remote code execution. The issue stems from an incomplete fix related to CVE-2021-29477. The CVSS score for this vulnerability is 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
6.0.14-r0
This is the first release that contains the fix.
sudo apk add --upgrade redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, a workaround is to configure Access Control Lists (ACL) to prevent clients from using the STRALGO LCS command. Additionally, on 64-bit systems with the fixes for CVE-2021-29477 (versions 6.2.3 or 6.0.13), ensure that the 'proto-max-bulk-len' configuration parameter is set to a value smaller than 2GB (default is 512MB).
Conclusion
The integer overflow vulnerability in Redis poses a significant risk, allowing for potential remote code execution. It is crucial to update to the patched versions or implement the suggested workarounds to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for redis →
FAQ
Exploitation of this vulnerability can lead to heap corruption and potentially allow an attacker to execute arbitrary code remotely.
You can check your Redis version using the command 'redis-server --version' and compare it against the fixed versions.
Implement the recommended workaround by configuring ACLs to restrict the use of the STRALGO LCS command.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Detailed information can be found in the CVE-2021-32625 report and through security advisories related to Redis.
References
Related vulnerabilities
Recent vulnerabilities recorded for redis.
