CVE-2021-32761: Integer overflow issues with *BIT commands on 32-bit systems
Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis BIT command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves changing the default proto-max-bulk-len configuration parameter to a very large value and constructing specially crafted commands bit commands. This problem only affects Redis on 32-bit platforms, or compiled as a 32-bit binary. Redis versions 5.0.3m 6.0.15, and 6.2.5 contain patches for this issue. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/redisto a version that resolves this vulnerability.Fixed in 5:5.0.14-1+deb10u2Fixed in 5:5.0.14-1+deb10u5Fixed in 5:6.0.16-1+deb11u2Fixed in 5:7.0.11-1Fixed in 5:7.0.14-1 - Upgrade
Upgrade
alpine/redisto a version that resolves this vulnerability.Fixed in 5.0.13-r0 - Upgrade
Upgrade
alpine/redisto a version that resolves this vulnerability.Fixed in 6.0.13-r0 - Upgrade
Upgrade
alpine/redisto a version that resolves this vulnerability.Fixed in 6.2.5-r0 - Upgrade
Upgrade
Redisto a version that resolves this vulnerability.Fixed in 5.0.13 - Upgrade
Upgrade
Redisto a version that resolves this vulnerability.Fixed in 6.0.15 - Upgrade
Upgrade
Redisto a version that resolves this vulnerability.Fixed in 6.2.5 - Configuration
Use ACL to prevent unprivileged users from modifying the proto-max-bulk-len configuration parameter.
Redis redis-server ACL access to CONFIG SET for proto-max-bulk-len = deny for unprivileged users
Event History
Frequently Asked Questions
What is CVE-2021-32761?
CVE-2021-32761 is a vulnerability in Redis, an in-memory database, that allows for out-of-bounds read, integer overflow, and buffer overflow attacks.
What versions of Redis are affected by CVE-2021-32761?
Redis versions prior to 5.0.13, 6.0.15, and 6.2.5 are affected by CVE-2021-32761.
How severe is CVE-2021-32761?
CVE-2021-32761 has a severity rating of 7.5 (high).
What is the impact of CVE-2021-32761?
CVE-2021-32761 can lead to out-of-bounds read, integer overflow, and buffer overflow attacks, potentially allowing an attacker to execute arbitrary code or cause a denial of service.
How can I mitigate the vulnerability CVE-2021-32761 in Redis?
To mitigate CVE-2021-32761, it is recommended to update Redis to versions 5.0.13, 6.0.15, or 6.2.5 or later, depending on the currently installed version.