CVE-2021-3470: Buffer Overflow
A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc, leading to potential out of bound write or process crash. Effectively this flaw does not affect the vast majority of users, who use jemalloc or glibc malloc.
Other sources
When using a system with no mallocusablesize(), zmallocsize() assumed that the heap allocator always returns blocks that are long-padded. This may not always be the case, and will result with zmallocsize() returning a size that is bigger than allocated. At least in one case this leads to out of bound write, process crash and a potential security vulnerability. Effectively this does not affect the vast majority of users, who use jemalloc or glibc.
Upstream pull request: https://github.com/redis/redis/pull/7963
Upstream commit: https://github.com/redis/redis/commit/9824fe3e392caa04dc1b4071886e9ac402dd6d95
Release notes: https://raw.githubusercontent.com/redis/redis/5.0.10/00-RELEASENOTES https://raw.githubusercontent.com/redis/redis/6.0.9/00-RELEASENOTES
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/redisto a version that resolves this vulnerability.Fixed in 5.0.10 - Upgrade
Upgrade
redhat/redisto a version that resolves this vulnerability.Fixed in 6.0.9 - Upgrade
Upgrade
redhat/redisto a version that resolves this vulnerability.Fixed in 6.2.0 - Upgrade
Upgrade
redis/redisto a version that resolves this vulnerability.Fixed in 5.0.10 - Upgrade
Upgrade
redis/redisto a version that resolves this vulnerability.Fixed in 6.0.9 - Upgrade
Upgrade
redis/redisto a version that resolves this vulnerability.Fixed in 6.2.0 - Compensating control
If you must run a Redis version before the fixed releases, ensure Redis is using jemalloc or glibc's malloc (the heap overflow issue is stated to not affect the vast majority of users who use jemalloc or glibc).
Event History
Frequently Asked Questions
What is CVE-2021-3470?
CVE-2021-3470 is a heap overflow issue found in Redis in versions before 5.0.10, before 6.0.9, and before 6.2.0 when using a heap allocator other than jemalloc or glibc's malloc.
What is the severity of CVE-2021-3470?
The severity of CVE-2021-3470 is medium with a severity value of 5.3.
Which software versions are affected by CVE-2021-3470?
Redis versions before 5.0.10, before 6.0.9, and before 6.2.0 are affected by CVE-2021-3470.
How does CVE-2021-3470 affect Redis users?
CVE-2021-3470 does not affect the vast majority of Redis users who use jemalloc as their heap allocator.
Where can I find more information about CVE-2021-3470?
You can find more information about CVE-2021-3470 at the following link: https://bugzilla.redhat.com/show_bug.cgi?id=1943623