Описание
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
A vulnerability found in Redis where a flaw in the Lua scripting engine can trigger a use-after-free condition. An authenticated attacker can exploit this by running a specially crafted Lua script, potentially resulting in remote code execution (RCE) within the Redis process.
Отчет
This vulnerability should be rated Important rather than Moderate because it introduces a memory-safety defect in Redis’s Lua subsystem that can be weaponized for remote code execution (RCE). An authenticated actor with permission to run Lua can craft scripts that trigger a use-after-free in the parser/stack-management code, giving precise control over freed memory and enabling arbitrary code execution inside the redis-server process. That risk is fundamentally different from a typical moderate issue (e.g., a crash or limited denial-of-service): successful exploitation directly compromises the server runtime and all in-memory contents—cached data, session tokens, and application state—rather than merely disrupting service. Because Redis commonly runs with elevated privileges and is a trusted core component in application architectures, an RCE in the server process undermines confidentiality, integrity, and availability across dependent services. Authenticated attackability, trivial exploitation via standard commands (EVAL/EVALSHA), and the potential for full-process compromise elevate CVE-2025-49844 to Important severity. This flaw exists only in the Redis server implementation; Redis client libraries (Python, Node.js, Rust, etc.) are not affected by this vulnerability, and it only exists in the Redis server’s embedded Lua engine where scripts execute. Client libraries merely transmit EVAL/EVALSHA to the server. Red Hat Satellite does not ship the Redis server, and the Redis client libraries it includes (such as python-redis, python-aioredis and rubygem-redis) are not impacted by this vulnerability. While Satellite consume the Redis package from the underlying RHEL system, which is affected, the Redis service in Satellite is bound only to the local interface and is accessible solely by internal components like Pulp and Dynflow. Since vulnerability requires sending crafted Lua payloads to the Redis command interface, and no external or untrusted clients can connect, the effective exposure within Satellite is nullified.
Меры по смягчению последствий
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. To reduce the risk, restricting network access to trusted hosts, enforcing strong authentication and protected-mode, disabling or limiting Lua scripting where possible can be beneficial and apply least-privilege ACLs to reduce who can run scripting commands, keep instances non-public with firewalls/VPCs, and follow Redis hardening guidance to minimize exposure.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Logging Subsystem for Red Hat OpenShift | openshift-logging/cluster-logging-operator-bundle | Not affected | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/cluster-logging-rhel9-operator | Not affected | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/eventrouter-rhel9 | Not affected | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/fluentd-rhel9 | Not affected | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/log-file-metric-exporter-rhel9 | Not affected | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/logging-view-plugin-rhel9 | Not affected | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/vector-rhel9 | Not affected | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/cluster-logging-operator-bundle | Not affected | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/cluster-logging-rhel9-operator | Not affected | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/eventrouter-rhel9 | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
Redis Lua Use-After-Free may lead to remote code execution
Redis is an open source, in-memory database that persists on disk. Ver ...
EPSS
8.8 High
CVSS3