Heap-based buffer overflow in Redis - CVE-2022-24834

Vulnerability identifier: #VU78506

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-24834

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the cjson and cmsgpack libraries. A remote attacker can trick the victim into using a specially crafted Lua script to trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Redis
Debian Linux
Gentoo Linux
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat Enterprise Linux for x86_64
Ubuntu
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Server Applications Module
openSUSE Leap
openEuler
Fedora
SmartFabric Storage Software
IBM Cloud Pak for Multicloud Management
Oracle Enterprise Operations Monitor
Oracle Communications Cloud Native Core Network Repository Function
EasyApache
redis-tools (Ubuntu package)
redis-server (Ubuntu package)
lua-bitop (Ubuntu package)
redis-debugsource
redis
redis-debuginfo
redis6
redis (Red Hat package)
redis-devel
redis-doc
redis7-debuginfo
redis7-debugsource
redis7
redis (Debian package)
dev-db/redis
HPE Unified OSS Console (UOC)
QRadar Assistant
Storage Protect Plus Container Agent
Juniper Junos Space

Install updates from vendor's website.

Redis - addressed in versions 6.0.20, 6.2.13, 7.0.12
SmartFabric Storage Software - update to 1.4.3
IBM Cloud Pak for Multicloud Management - update to 2.3.8
redis-tools (Ubuntu package) - update to Ubuntu Pro
redis-server (Ubuntu package) - update to Ubuntu Pro
lua-bitop (Ubuntu package) - addressed in versions 1.0.2-5ubuntu0.20.04.1~esm2, 1.0.2-5ubuntu0.22.04.1~esm2, 2.1.0+dfsg-2.1ubuntu0.20.04.1~esm2, 2.1.0+dfsg-2.1ubuntu0.22.04.1~esm2, 2:3.0.6-1ubuntu0.4+esm5, 5:4.0.9-1ubuntu0.2+esm7, 5.1.5-8.1ubuntu0.20.04.1~esm1, 5.1.5-8.1ubuntu0.22.04.1~esm1, 5:7.0.15-1ubuntu0.24.04.4
HPE Unified OSS Console (UOC) - update to 3.1.0
QRadar Assistant - update to 3.8.1
redis-debugsource - update to 4.0.11-19
redis - update to 4.0.11-19
redis-debuginfo - update to 4.0.11-19
EasyApache - update to 4 2024-1-24
redis-debuginfo - addressed in versions 6.0.14-150200.6.26.1, 6.2.6-150400.3.22.1
redis - addressed in versions 6.0.14-150200.6.26.1, 6.2.6-150400.3.22.1
redis-debugsource - addressed in versions 6.0.14-150200.6.26.1, 6.2.6-150400.3.22.1
redis6 - update to 6.2.13-1
redis (Red Hat package) - update to 6.2.17-1.el9_5
redis - update to 6.2.17-1.0.1
redis-devel - update to 6.2.17-1.0.1
redis-doc - update to 6.2.17-1.0.1
redis7-debuginfo - update to 7.0.8-150500.3.3.1
redis7-debugsource - update to 7.0.8-150500.3.3.1
redis7 - update to 7.0.8-150500.3.3.1
redis - addressed in versions 7.0.12-1.fc37, 7.0.12-1.fc38
redis (Debian package) - update to 5:7.0.15-1~deb12u1
dev-db/redis - update to 7.2.4
Storage Protect Plus Container Agent - update to 10.1.12.7
Juniper Junos Space - update to 24.1R5

• Exploit #9212 - CVE-2022-24834 () (July 30, 2023)

• https://github.com/redis/redis/security/advisories/GHSA-p8x2-9v9q-c838
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/

• Multiple vulnerabilities in Redis
• SUSE update for redis7
• SUSE update for redis
• Fedora 38 update for redis
• Fedora 37 update for redis
• SUSE update for redis
• Multiple vulnerabilities in Oracle Enterprise Operations Monitor
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Ubuntu update for redis
• Multiple vulnerabilities in HPE Unified OSS Console
• Multiple vulnerabilities in cPanel EasyApache
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• openEuler update for redis
• Multiple vulnerabilities in IBM Storage Protect Plus Container Agent
• Debian update for redis
• Gentoo update for Redis
• Multiple vulnerabilities in IBM QRadar Assistant
• Red Hat Enterprise Linux 8 update for the redis:6 module
• Red Hat Enterprise Linux 9 update for redis
• Amazon Linux AMI update for redis6
• Anolis OS update for redis:6 module
• Dell SmartFabric Storage Software update for third-party components
• Multiple vulnerabilities in Junos Space
• Ubuntu update for lua-bitop