8.10.0 Wed, Jul 29
SECURITY: There is a security fix in the release. ### Security fixes - RedisBloom/RedisBloom#1044 Crafted RESTORE payloads in RedisBloom and TDigest may trigger out-of-bounds writes, potentially leading to remote code execution
Update urgency: `SECURITY`: There is a security fix in the release. ### Security fixes - A crafted stream `RESTORE` payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
Update urgency: `SECURITY`: There is a security fix in the release. ### Security fixes - A crafted stream `RESTORE` payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
Update urgency: `SECURITY`: There is a security fix in the release. ### Security fixes - A crafted stream `RESTORE` payload can make two consumers share the same NACK, leading to a use-after-free that may result in Remote Code Execution
This is the second Release Candidate of Redis 8.10 in Redis Open Source. Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use. ### Bug fixes (compared to 8.10-RC1) - A user can manipulate data read by a connection by injecting \r\n sequences into a Redis error reply - A typo in release.h that could cause build failures
This is the first Release Candidate of Redis 8.10 in Redis Open Source. Release Candidates are feature-complete pre-releases. Pre-releases are not suitable for production use. ### Headlines: Redis 8.10 introduces new features and performance improvements.
### Impact A vulnerability in the Redis RESTORE command allows an authenticated user to trigger an invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution. Successful exploitation could allow an attacker with authenticated access to execute arbitrary code in the context of the Redis server, potentially leading to full compromise of the affected system, data exfiltration, or service disruption This problem affects all Redis versions.
### Impact An authenticated user may exploit the synchronization mechanism of the master-replica and trigger a use-after-free vulnerability, potentially leading to remote code execution.
### Impact When a blocked client is evicted while re-executing a blocked command, an authenticated user may trigger a use-after-free and potentially lead to remote code execution. The problem exists in Redis `7.2` or newer. ### Details The code doesn't handle the case where processing the command (`processCommandAndResetClient`) returns an error value. ### Credits The issue was reported by independent researcher Xint Code during the Wiz Zeroday Cloud event.
### Impact A user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. The problem exists in Redis 8.2 or newer. ### Details The code doesn't handle the case where the number of ID's exceeds the STREAMID_STATIC_VECTOR_LEN, and skips a reallocation, which leads to a stack buffer overflow.
### Impact An authenticated user may use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user The problem exists in all versions of Redis with Lua scripting. ### Workarounds An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts.
### Impact An authenticated user may use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting ### Workarounds An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.
### Impact An authenticated user may use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. ### Workarounds An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.
### Impact An authenticated user may use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. ### Workarounds An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
From time to time we discover situations where the Redis application will allow a logged-in user to cause a denial-of-service or otherwise impact the performance or availability of the database they have access to, which can happen without explicitly violating the Redis Security Model. In some cases, such as CVE-2024-31227 and CVE-2024-31228, we elect to fix these denial-of-service possibilities in code as they result from error conditions.
### Impact An unauthenticated connection can cause repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. The problem affects all versions of Redis. ### Patches The problem is fixed in Redis 6.2.X, 7.2.X, 7.4.X and 8.0.X ### Credit The problem was reported by @julienperriercornet
### Impact An authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. ### Workarounds An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.
### Impact A user can run the redis-check-aof cli and pass a long file path to trigger a stack buffer overflow, which may potentially lead to remote code execution. The problem exists in Redis 7.0 or newer. ### Details A stack-based buffer overflow exists in redis-check-aof due to the use of `memcpy` with `strlen(filepath)` when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution.
### Summary An unauthenticated client can cause unlimited growth of output buffers, until the server runs out of memory or is killed. ### Details By default, the Redis configuration does not limit the output buffer of normal clients (see client-output-buffer-limit). Therefore, the output buffer can grow unlimitedly over time. As a result, the service is exhausted and the memory is unavailable.
### Impact An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7.0.0 or newer. ### Patches The problem is fixed in Redis 7.2.7 and 7.4.2. ### Credit The problem was reported by Axel Mierczuk.
### Impact An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. ### Patches The problem is fixed in Redis 6.2.x, 7.2.x and 7.4.x. ### Workarounds An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts.
### Impact An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. ### Patches The problem is fixed in Redis 6.2.16, 7.2.6, 7.4.1. ### Credit The problem was reported by ankki-zsyang, Shenzhen Ankki Technologies Co.Ltd.
### Impact An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7.0.0 or newer. ### Patches The problem is fixed in Redis 7.2.6 and 7.4.1. ### Credit The problem was reported by Axel Mierczuk.
### Impact Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. The problem affects all versions of Redis. ### Patches The problem is fixed in Redis 6.2.16, 7.2.6, and 7.4.1.
### Impact In some cases, Redis may incorrectly handle resizing of memory buffers which can result in incorrect accounting of buffer sizes and lead to heap overflow and potential remote code execution. The problem exists in Redis 7.0.9 or newer (including 7.2.x). ### Patches The problem is fixed in Redis 7.0.15 and 7.2.4.
### Impact On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. The problem exists since Redis 2.6.0-RC1. ### Patches The problem is fixed in Redis 7.2.2, 7.0.14 or 6.2.14.
### Impact Redis does not correctly identify keys accessed by `SORT_RO` and, as a result, may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer. ### Patches The problem is fixed in Redis 7.0.13 and 7.2.1. ### Credit The problem was found by yangbodong22011.
### Impact Extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Several scenarios that may lead to this result: * Authenticated users executing a specially crafted `COMMAND GETKEYS` or `COMMAND GETKEYSANDFLAGS`.
### Impact A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. ### Patches The problem is fixed in versions 7.0.12, 6.2.13, 6.0.20.
### Impact Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that may later crash Redis on access. ### Patches The problem is fixed in Redis versions 7.0.11, 6.2.12 and 6.0.19. ### For more information If you have any questions or comments about this advisory: * Open an issue in [the Redis repository](https://github.com/redis/redis) * Email us at [[email protected]](mailto:[email protected])
### Impact Authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. ### Patches The problem is fixed in Redis versions 7.0.10. ### Credit The issue has been identified by Yupeng Yang. ### For more information If you have any questions or comments about this advisory: * Open an issue in [the Redis repository](https://github.com/redis/redis) * Email us at [[email protected]](mailto:[email protected])
### Impact Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. ### Patches The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9. ### Credit The issue has been identified by Yupeng Yang.
### Impact Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. ### Patches The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9. ### Credit The issue has been identified by Tom Levy.
### Impact Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion. This problem affects Redis 6.2 or newer. ### Patches The problem is fixed in Redis versions 6.2.9 and 7.0.8. ### Credit This issue has been identified and reported by yype on GitHub.
### Impact Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an OOM panic. ### Patches The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17.
### Impact Executing a `XAUTOCLAIM` command on a stream key in a specific state, with a specially crafted `COUNT` argument may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code execution. The problem affects Redis versions 7.0.0 or newer. ### Patches The problem is fixed in Redis version 7.0.5. ### Credits This problem was identified by Xion (SeungHyun Lee) of KAIST GoN.
### Impact A specially crafted `XAUTOCLAIM` command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. The problem affects Redis versions 7.0.0 or newer. ### Patches The problem is fixed in Redis version 7.0.4. ### For more information If you have any questions or comments about this advisory: * Open an issue in [the Redis repository](https://github.com/redis/redis) * Email us at [email protected]
### Impact By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. The Lua script execution environment in Redis provides some measures that prevent a script from creating side effects that persist and can affect the execution of the same, or different script, at a later time.
### Impact An attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. This issue affects all versions of Redis. ### Patches The problem is fixed in Redis versions 7.0.0 and 6.2.7. ### Workarounds An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.
### Impact The `DEBUG` command has several potential security implications if used incorrectly or by unauthorized users. It exists mainly for advanced troubleshooting and by the Redis test suite. While it is possible to block it using ACL configuration, this was not the default configuration before Redis 7.0.0.
### Impact An integer overflow bug in the underlying string library can be used to corrupt the heap and potentially result with denial of service or remote code execution. The vulnerability involves changing the default `proto-max-bulk-len` configuration parameter to a very large value and constructing specially crafted network payloads or commands. ### Patches The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14.
### Impact The `redis-cli` command line tool and `redis-sentinel` service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This is a result of a vulnerability in the underlying `hiredis` library which does not perform an overflow check before calling the `calloc()` heap allocation function. This issue only impacts systems with heap allocators that do not perform their own overflow checks.
### Impact An integer overflow bug affecting all versions of Redis can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution. The vulnerability involves changing the default `set-max-intset-entries` configuration parameter to a very large value and constructing specially crafted commands to manipulate sets. ### Patches The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14.
### Impact When parsing an incoming Redis Standard Protocol (RESP) request, Redis allocates memory according to user-specified values which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). An attacker delivering specially crafted requests over multiple connections can cause the server to allocate significant amount of memory.
### Impact When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). ### Patches The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. ### Credit This problem was found by Meir Shpilraien.
### Impact An integer overflow bug in the ziplist data structure used by all versions of Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves modifying the default ziplist configuration parameters (`hash-max-ziplist-entries`, `hash-max-ziplist-value`, `zset-max-ziplist-entries` or `zset-max-ziplist-value`) to a very large value, and then constructing specially crafted commands to create very large ziplists.