CVE-2021-32626: Lua scripts can overflow the heap-based Lua stack in Redis
A heap buffer overflow was found in redis. Specially crafted Lua scripts executing in Redis cause the heap-based Lua stack to overflow due to incomplete checks for this condition. This flaw allows a remote attacker to corrupt the heap and potentially trigger remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Other sources
Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/redisto a version that resolves this vulnerability.Fixed in 0:3.2.8-5.el7 - Upgrade
Upgrade
redhat/rh-redis5-redisto a version that resolves this vulnerability.Fixed in 0:5.0.5-3.el7 - Upgrade
Upgrade
debian/redisto a version that resolves this vulnerability.Fixed in 5:5.0.14-1+deb10u2Fixed in 5:5.0.14-1+deb10u5Fixed in 5:6.0.16-1+deb11u2Fixed in 5:7.0.11-1Fixed in 5:7.0.14-1 - Upgrade
Upgrade
redhat/redisto a version that resolves this vulnerability.Fixed in 6.2.6 - Upgrade
Upgrade
redhat/redisto a version that resolves this vulnerability.Fixed in 6.0.16 - Upgrade
Upgrade
redhat/redisto a version that resolves this vulnerability.Fixed in 5.0.14 - Upgrade
Upgrade
Redisto a version that resolves this vulnerability.Fixed in 6.2.6 - Upgrade
Upgrade
Redisto a version that resolves this vulnerability.Fixed in 6.0.16 - Upgrade
Upgrade
Redisto a version that resolves this vulnerability.Fixed in 5.0.14 - Configuration
Use Redis ACL to prevent users from executing Lua scripts by restricting (denying) the EVAL and EVALSHA commands.
Redis ACL deny commands = EVAL and EVALSHA
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2021-32626.
What is the severity of CVE-2021-32626?
The severity of CVE-2021-32626 is high with a severity value of 8.8.
Which software versions are affected by CVE-2021-32626?
CVE-2021-32626 affects Redis versions 2.6 to 6.2.6.
How can this vulnerability be fixed?
To fix CVE-2021-32626, upgrade to Redis version 6.2.6.
Are there any references or additional information for CVE-2021-32626?
Yes, there are references and additional information available for CVE-2021-32626. They can be found at the following links: [Link 1](https://github.com/redis/redis/commit/666ed7facf4524bf6d19b11b20faa2cf93fdf591), [Link 2](https://github.com/redis/redis/security/advisories/GHSA-p486-xggp-782c), [Link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2012217).