Heap-based buffer overflow in Redis - CVE-2023-36824

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU78507

Heap-based buffer overflow in Redis - CVE-2023-36824

Published: July 21, 2023


Vulnerability identifier: #VU78507
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-36824
CWE-ID: CWE-122
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when extracting key names from a command and a list of arguments. A local user can execute the "COMMAND GETKEYS" or "COMMAND GETKEYSANDFLAGS" commands or execute a specially crafted command that refers to a variadic list of key names along with ACL rules that match key names to trigger a heap-based buffer overflow and execute arbitrary code on the target system.


Affected software

Redis
Debian Linux
Gentoo Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Server Applications Module
openSUSE Leap
Fedora
redis7
redis7-debuginfo
redis7-debugsource
redis
redis (Debian package)
dev-db/redis

How to mitigate CVE-2023-36824

Install updates from vendor's website.

Redis - update to 7.0.12
redis7 - update to 7.0.8-150500.3.3.1
redis7-debuginfo - update to 7.0.8-150500.3.3.1
redis7-debugsource - update to 7.0.8-150500.3.3.1
redis - addressed in versions 7.0.12-1.fc37, 7.0.12-1.fc38
redis (Debian package) - update to 5:7.0.15-1~deb12u1
dev-db/redis - update to 7.2.4

External References

Related Security Bulletins