CVE-2021-41099: Integer overflow issue with strings in Redis
An integer overflow issue was found in redis in the underlying string library. The vulnerability involves changing the default "proto-max-bulk-len" configuration parameter to a very large value and constructing specially crafted network payloads or commands. This flaw allows a remote attacker to corrupt the heap and potentially trigger remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Other sources
Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to corrupt the heap and potentially result with denial of service or remote code execution. The vulnerability involves changing the default proto-max-bulk-len configuration parameter to a very large value and constructing specially crafted network payloads or commands. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/redisto a version that resolves this vulnerability.Fixed in 0:3.2.8-5.el7 - Upgrade
Upgrade
redhat/rh-redis5-redisto a version that resolves this vulnerability.Fixed in 0:5.0.5-3.el7 - Upgrade
Upgrade
debian/redisto a version that resolves this vulnerability.Fixed in 5:5.0.14-1+deb10u2Fixed in 5:5.0.14-1+deb10u5Fixed in 5:6.0.16-1+deb11u2Fixed in 5:7.0.11-1Fixed in 5:7.0.14-1 - Upgrade
Upgrade
redhat/redisto a version that resolves this vulnerability.Fixed in 6.2.6 - Upgrade
Upgrade
redhat/redisto a version that resolves this vulnerability.Fixed in 6.0.16 - Upgrade
Upgrade
redhat/redisto a version that resolves this vulnerability.Fixed in 5.0.14 - Upgrade
Upgrade
redisto a version that resolves this vulnerability.Fixed in 6.2.6 - Upgrade
Upgrade
redisto a version that resolves this vulnerability.Fixed in 6.0.16 - Upgrade
Upgrade
redisto a version that resolves this vulnerability.Fixed in 5.0.14 - Configuration
Mitigate without patching by using Redis ACL to prevent unprivileged users from using the CONFIG SET command (so clients cannot modify the `proto-max-bulk-len` configuration parameter).
Redis ACL CONFIG SET command access = disallow
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-41099?
CVE-2021-41099 is an integer overflow vulnerability in Redis that can lead to denial of service or remote code execution.
What is the severity of CVE-2021-41099?
CVE-2021-41099 has a severity rating of 7.5 (High).
How does CVE-2021-41099 affect Redis?
CVE-2021-41099 affects Redis by corrupting the heap through an integer overflow bug in the underlying string library.
How can I fix CVE-2021-41099?
To fix CVE-2021-41099, upgrade to Redis version 6.2.6, 6.0.16, or 5.0.14, depending on your current version.
Where can I find more information about CVE-2021-41099?
You can find more information about CVE-2021-41099 on the Redis GitHub page and the Redis security advisories.