Integer overflow in Redis - CVE-2021-29477

Vulnerability identifier: #VU52828

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-29477

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in STRALGO LCS command. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Redis
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
SUSE Linux Enterprise Module for Server Applications
openEuler
Fedora
IBM Cloud Application Performance Management (APM)
redis-doc
redis-devel
redis
redis-debuginfo
redis-debugsource
redis6
redis6-debugsource
redis6-devel
redis6-debuginfo
redis6-doc
Robotic Process Automation for Cloud Pak

Install updates from vendor's website.

Redis - addressed in versions 6.0.13, 6.2.3
redis-doc - update to 6.0.9-3
redis-devel - update to 6.0.9-3
redis - update to 6.0.9-3
redis - addressed in versions 6.0.13-1.fc33, 6.0.14-1.fc33, 6.2.3-1.fc34, 6.2.4-1.fc34
redis-debuginfo - update to 6.0.13-1.10.1
redis-debugsource - update to 6.0.13-1.10.1
redis - update to 6.0.13-1.10.1
redis6 - update to 6.2.7-1
redis6-debugsource - update to 6.2.7-1
redis6-devel - update to 6.2.7-1
redis6-debuginfo - update to 6.2.7-1
redis6-doc - update to 6.2.7-1
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.6, 23.0.7

• https://github.com/redis/redis/releases/tag/6.0.13
• https://github.com/redis/redis/releases/tag/6.2.3

• Multiple vulnerabilities in Redis
• Red Hat Enterprise Linux 8 update for the redis:6 module
• Gentoo update for Redis
• SUSE update for redis
• Multiple vulnerabilities in IBM Application Performance Management
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• openEuler update for redis6
• Fedora 34 update for redis
• Fedora 33 update for redis
• Fedora 33 update for redis
• Fedora 34 update for redis
• Anolis OS update for redis:6 module