Описание
Invalid Memory Access in Redis RESTORE Command May Lead to Remote Code Execution
Impact
A vulnerability in the Redis RESTORE command allows an authenticated user to trigger an invalid memory access via a specially crafted serialized payload, potentially resulting in remote code execution.
Successful exploitation could allow an attacker with authenticated access to execute arbitrary code in the context of the Redis server, potentially leading to full compromise of the affected system, data exfiltration, or service disruption
This problem affects all Redis versions.
Details
The vulnerability is caused by insufficient validation of serialized values processed by the RESTORE command, which allows malformed input to trigger unsafe memory accesses.
Attack Prerequisites
- The attacker must be authenticated to the Redis instance.
- The attacker must have permission to execute the RESTORE command.
Workarounds
An additional workaround to mitigate the issue without patching the Redis server executable is to prevent users from executing the RESTORE command by applying an appropriate ACL restriction rule.
Credit
- Emil Lerner during the Wiz Zeroday Cloud event.
- Joseph Surin
Пакеты
redis
>=6.2.0, <6.2.22
6.2.22
redis
>=7.2.0, <7.2.14
7.2.14
redis
>=7.4.0, <7.4.9
7.4.9
redis
>=8.2.0, <8.2.6
8.2.6
redis
>=8.4.0, <8.4.3
8.4.3
redis
>=8.6.0, <8.6.3
8.6.3
Связанные уязвимости
Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.
Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.
Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.
redis-server RESTORE invalid memory access may allow remote code execution
Redis is an in-memory data structure store. In versions of redis-serve ...