#VU78507 Heap-based buffer overflow in Redis - CVE-2023-36824

Vulnerability identifier: #VU78507

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-36824

CWE-ID: CWE-122

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Redis
Server applications / Database software

Vendor: Redis Labs

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when extracting key names from a command and a list of arguments. A local user can execute the "COMMAND GETKEYS" or "COMMAND GETKEYSANDFLAGS" commands or execute a specially crafted command that refers to a variadic list of key names along with ACL rules that match key names to trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Redis: 7.0.0 - 7.0.11

---

External links
https://github.com/redis/redis/security/advisories/GHSA-4cfx-h9gq-xpx3
https://github.com/redis/redis/releases/tag/7.0.12
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.