CVE-2021-32628: Vulnerability in handling large ziplists
An integer overflow issue was found in the redis ziplist data structure. The vulnerability involves modifying the default ziplist configuration parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value) to a very large value, and then constructing specially crafted commands to create very large ziplists. This flaw allows a remote attacker to corrupt the heap and potentially trigger remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Other sources
Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the ziplist data structure used by all versions of Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves modifying the default ziplist configuration parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value) to a very large value, and then constructing specially crafted commands to create very large ziplists. The problem is fixed in Redis versions 6.2.6, 6.0.16, 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the above configuration parameters. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/redisto a version that resolves this vulnerability.Fixed in 0:3.2.8-5.el7 - Upgrade
Upgrade
redhat/rh-redis5-redisto a version that resolves this vulnerability.Fixed in 0:5.0.5-3.el7 - Upgrade
Upgrade
debian/redisto a version that resolves this vulnerability.Fixed in 5:5.0.14-1+deb10u2Fixed in 5:5.0.14-1+deb10u5Fixed in 5:6.0.16-1+deb11u2Fixed in 5:7.0.11-1Fixed in 5:7.0.14-1 - Upgrade
Upgrade
redhat/redisto a version that resolves this vulnerability.Fixed in 6.2.6 - Upgrade
Upgrade
redhat/redisto a version that resolves this vulnerability.Fixed in 6.0.16 - Upgrade
Upgrade
redhat/redisto a version that resolves this vulnerability.Fixed in 5.0.14 - Upgrade
Upgrade
redisto a version that resolves this vulnerability.Fixed in 6.2.6 - Upgrade
Upgrade
redisto a version that resolves this vulnerability.Fixed in 6.0.16 - Upgrade
Upgrade
redisto a version that resolves this vulnerability.Fixed in 5.0.14 - Configuration
Using Redis ACL (see redis.io/topics/acl), disallow unprivileged users from using the CONFIG SET command to prevent changing ziplist configuration parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries, zset-max-ziplist-value) to very large values.
Redis ACL CONFIG SET command permission (disallow CONFIG SET) = deny
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-32628.
What is Redis?
Redis is an open-source, in-memory database that persists on disk.
What is the severity of CVE-2021-32628?
The severity of CVE-2021-32628 is high with a CVSS score of 7.5.
How does the vulnerability in ziplist data structure in Redis affect the system?
The vulnerability can be exploited to corrupt the heap and potentially result in remote code execution.
How can I fix the CVE-2021-32628 vulnerability in Redis?
The recommended fix for CVE-2021-32628 is to update Redis to version 6.2.6 or apply the appropriate patches provided by the vendor.