REDHAT-BUG-2466788: Use After Free
Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.6.3 - Compensating control
Apply the described workaround: prevent users from executing Lua scripts and/or avoid using replicas where replica-read-only is disabled (or can be disabled).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2466788?
The severity of REDHAT-BUG-2466788 is rated as high with a score of 7.
How do I fix REDHAT-BUG-2466788?
To resolve REDHAT-BUG-2466788, update to the latest patched version of Redis that addresses the vulnerability.
What kind of attack can be executed due to REDHAT-BUG-2466788?
An authenticated attacker can exploit the vulnerability to trigger a use-after-free condition that affects replicas.
What conditions must be met for REDHAT-BUG-2466788 to be exploited?
Exploitation of REDHAT-BUG-2466788 requires that replica-read-only is disabled or not enforced on the replicas.
Is LUA scripting in Redis related to REDHAT-BUG-2466788?
Yes, the vulnerability in REDHAT-BUG-2466788 affects all versions of redis-server that support Lua scripting.