Integer overflow in Redis - CVE-2023-25155

Vulnerability identifier: #VU72649

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-25155

CWE-ID: CWE-190

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow in the "SRANDMEMBER", "ZRANDMEMBER" and "HRANDFIELD" commands. A local user can pass specially crafted data to the application, trigger integer overflow and cause a denial of service condition on the target system.

Redis
Gentoo Linux
Amazon Linux AMI
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Ubuntu
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Server Applications Module
openSUSE Leap
openEuler
Fedora
SmartFabric Storage Software
IBM Cloud Pak for Multicloud Management
Event Streams
redis-tools (Ubuntu package)
redis-server (Ubuntu package)
redis-debuginfo
redis
redis-debugsource
redis6
redis-devel
redis-doc
redis7
redis7-debuginfo
redis7-debugsource
dev-db/redis
EasyApache
Storage Protect Plus Container Agent
SmartFabric OS10
Robotic Process Automation for Cloud Pak

Install updates from vendor's website.

Redis - addressed in versions 6.0.18, 6.2.11, 7.0.9
SmartFabric Storage Software - update to 1.4.3
IBM Cloud Pak for Multicloud Management - update to 2.3.8
Event Streams - update to 11.1.5
redis-tools (Ubuntu package) - update to Ubuntu Pro
redis-server (Ubuntu package) - update to Ubuntu Pro
EasyApache - update to 4 2024-1-24
redis-debuginfo - addressed in versions 6.0.14-150200.6.20.1, 6.2.6-150400.3.16.1, 6.2.6-150400.3.19.1
redis - addressed in versions 6.0.14-150200.6.20.1, 6.2.6-150400.3.16.1, 6.2.6-150400.3.19.1
redis-debugsource - addressed in versions 6.0.14-150200.6.20.1, 6.2.6-150400.3.16.1, 6.2.6-150400.3.19.1
redis6 - update to 6.2.11-1
redis - addressed in versions 6.2.11-1.fc36, 7.0.9-1.fc37, 7.0.9-1.fc38
redis-devel - update to 6.2.17-1.0.1
redis - update to 6.2.17-1.0.1
redis-doc - update to 6.2.17-1.0.1
redis7 - update to 7.0.8-150500.3.3.1
redis7-debuginfo - update to 7.0.8-150500.3.3.1
redis7-debugsource - update to 7.0.8-150500.3.3.1
dev-db/redis - update to 7.2.4
redis - update to 7.2.7-1
redis-debuginfo - update to 7.2.7-1
redis-debugsource - update to 7.2.7-1
Storage Protect Plus Container Agent - update to 10.1.12.6
SmartFabric OS10 - addressed in versions 10.5.4.15, 10.5.5.14, 10.5.6.9
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.12, 23.0.12

• https://github.com/redis/redis/security/advisories/GHSA-x2r7-j9vw-3w83
• https://github.com/redis/redis/releases/tag/6.0.18
• https://github.com/redis/redis/releases/tag/7.0.9
• https://github.com/redis/redis/releases/tag/6.2.11

• Denial of service in Redis
• SUSE update for redis
• SUSE update for redis
• Integer overflow in IBM Event Streams
• SUSE update for redis
• SUSE update for redis7
• Multiple vulnerabilities in IBM Spectrum Protect Plus Container
• Fedora 36 update for redis
• Fedora 37 update for redis
• Fedora 38 update for redis
• Ubuntu update for redis
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in cPanel EasyApache
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• Amazon Linux AMI update for redis6
• Gentoo update for Redis
• Red Hat Enterprise Linux 8 update for the redis:6 module
• openEuler update for redis
• Anolis OS update for redis:6 module
• Dell SmartFabric Storage Software update for third-party components
• Multiple vulnerabilities in Dell SmartFabric OS10
• Dell SmartFabric OS10 update for third-party components
• Dell Networking OS10 update for third-party components