Описание
Lua Use-After-Free may lead to remote code execution
Impact
An authenticated user may exploit the synchronization mechanism of the master-replica and trigger a use-after-free vulnerability, potentially leading to remote code execution.
The bug affects only replicas that are configured, or may be configured with replica-read-only disabled , and exists in all versions of Redis with Lua scripting
Workarounds
An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled
Credit
The issue was reported by independent researcher Yoni Sherez identified DarkReplica during the Wiz Zeroday Cloud event.
Пакеты
redis
>=6.2.0, <6.2.22
6.2.22
redis
>=7.2.0, <7.2.14
7.2.14
redis
>=7.4.0, <7.4.9
7.4.9
redis
>=8.2.0, <8.2.6
8.2.6
redis
>=8.4.0, <8.4.3
8.4.3
redis
>=8.6.0, <8.6.3
8.6.3
Связанные уязвимости
Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.
Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.
Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.
redis-server Lua use-after-free may allow remote code execution
Redis is an in-memory data structure store. In all versions of redis-s ...