REDHAT-BUG-2466780: Use After Free
Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from processCommandAndResetClient when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redis-serverto a version that resolves this vulnerability.Fixed in 8.6.3
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2466780?
The severity of REDHAT-BUG-2466780 is classified as high with a score of 7.
What is the description of REDHAT-BUG-2466780?
REDHAT-BUG-2466780 pertains to an issue in redis-server where the unblock client flow fails to properly handle an error, potentially allowing an authenticated attacker to exploit it.
How can I mitigate REDHAT-BUG-2466780?
To mitigate REDHAT-BUG-2466780, upgrade redis-server to a version later than 8.6.3.
Which versions of Redis are affected by REDHAT-BUG-2466780?
Redis versions from 7.2.0 up to 8.6.3 are affected by REDHAT-BUG-2466780.
What is the potential impact of REDHAT-BUG-2466780?
The potential impact of REDHAT-BUG-2466780 includes allowing an authenticated attacker to trigger vulnerabilities due to improper error handling in blocked command execution.