Integer overflow in Redis - CVE-2021-29478

Vulnerability identifier: #VU52829

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-29478

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in COPY command for large intsets. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system for Redis starting with 6.2. Vulnerability exploitation in older versions results in a corrupted RDB or DUMP payload.

Redis
Gentoo Linux
SUSE Linux Enterprise Module for Server Applications
openEuler
Fedora
IBM Cloud Application Performance Management (APM)
redis
redis-debuginfo
redis-debugsource
Robotic Process Automation for Cloud Pak

Install updates from vendor's website.

Redis - addressed in versions 6.0.13, 6.2.3
redis - update to 4.0.11-15
redis-debuginfo - update to 4.0.11-15
redis-debugsource - update to 4.0.11-15
redis - addressed in versions 6.0.13-1.fc33, 6.2.3-1.fc34
redis - update to 6.0.13-1.10.1
redis-debuginfo - update to 6.0.13-1.10.1
redis-debugsource - update to 6.0.13-1.10.1
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.6, 23.0.7

• https://github.com/redis/redis/releases/tag/6.0.13
• https://github.com/redis/redis/releases/tag/6.2.3

• Multiple vulnerabilities in Redis
• Gentoo update for Redis
• SUSE update for redis
• Multiple vulnerabilities in IBM Application Performance Management
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• openEuler 20.03 LTS SP1 update for redis
• Fedora 34 update for redis
• Fedora 33 update for redis