Описание
Use-After-Free in unblock client flow may lead to remote code execution
Impact
When a blocked client is evicted while re-executing a blocked command, an authenticated user may trigger a use-after-free and potentially lead to remote code execution.
The problem exists in Redis 7.2 or newer.
Details
The code doesn't handle the case where processing the command (processCommandAndResetClient) returns an error value.
Credits
The issue was reported by independent researcher Xint Code during the Wiz Zeroday Cloud event.
Пакеты
redis
>=7.2.0, <7.2.14
7.2.14
redis
>=7.4.0, <7.4.9
7.4.9
redis
>=8.2.0, <8.2.6
8.2.6
redis
>=8.4.0, <8.4.3
8.4.3
redis
>=8.6.0, <8.6.3
8.6.3
Связанные уязвимости
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
redis-server use-after-free in unblock client flow may allow remote code execution
Redis is an in-memory data structure store. In redis-server from 7.2.0 ...