F5-K000159544: Use After Free
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
Affected Software
Event History
Frequently Asked Questions
What is the severity of F5-K000159544?
The severity of F5-K000159544 is critical due to the potential for remote code execution linked to a use-after-free vulnerability.
How do I fix F5-K000159544?
To fix F5-K000159544, upgrade Redis to version 8.2.2 or later to mitigate the vulnerability.
Who is affected by F5-K000159544?
F5-K000159544 affects users of F5 BIG-IP Next SPK, CNF, and Kubernetes across specific version ranges.
What kind of attack can be executed using F5-K000159544?
An attacker can execute a specially crafted Lua script to manipulate the garbage collector, potentially leading to remote code execution.
Is authentication required to exploit F5-K000159544?
Yes, an authenticated user is required to exploit the vulnerability described in F5-K000159544.