Race condition in Redis - CVE-2023-45145

Vulnerability identifier: #VU82200

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-45145

CWE-ID: CWE-362

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition between listen(2) and chmod(2) calls on startup. A local user can exploit the race and escalate privileges on the system.

Redis
Debian Linux
Amazon Linux AMI
Gentoo Linux
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for ARM 64
Ubuntu
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Server Applications Module
openSUSE Leap
openEuler
Fedora
SmartFabric Storage Software
IBM Cloud Pak for Multicloud Management
IBM DataPower Gateway
Oracle Communications Fraud Monitor
Oracle Communications Cloud Native Core Network Repository Function
EasyApache
redis-server (Ubuntu package)
redis-tools (Ubuntu package)
redis-debugsource
redis-debuginfo
redis
redis6
redis (Red Hat package)
redis-devel
redis-doc
redis7-debuginfo
redis7
redis7-debugsource
redis (Debian package)
dev-db/redis
QRadar Assistant
QRadar Hub
Storage Protect Plus Container Agent
Juniper Junos Space

Install updates from vendor's website.

Redis - addressed in versions 6.2.14, 7.0.14, 7.2.2
SmartFabric Storage Software - update to 1.4.3
IBM Cloud Pak for Multicloud Management - update to 2.3.8
redis-server (Ubuntu package) - update to Ubuntu Pro
redis-tools (Ubuntu package) - update to Ubuntu Pro
QRadar Assistant - update to 3.8.1
QRadar Hub - update to 3.9.0
redis-debugsource - addressed in versions 4.0.11-20, 4.0.14-7
redis-debuginfo - addressed in versions 4.0.11-20, 4.0.14-7
redis - addressed in versions 4.0.11-20, 4.0.14-7
EasyApache - update to 4 2024-1-24
redis-debugsource - addressed in versions 6.0.14-150200.6.29.1, 6.2.6-150400.3.25.1
redis - addressed in versions 6.0.14-150200.6.29.1, 6.2.6-150400.3.25.1
redis-debuginfo - addressed in versions 6.0.14-150200.6.29.1, 6.2.6-150400.3.25.1
redis6 - update to 6.2.14-1
redis (Red Hat package) - update to 6.2.17-1.el9_5
redis - addressed in versions 6.2.17-1.0.1, 7.0.14-1
redis-devel - addressed in versions 6.2.17-1.0.1, 7.0.14-1
redis-doc - addressed in versions 6.2.17-1.0.1, 7.0.14-1
redis7-debuginfo - update to 7.0.8-150500.3.9.1
redis7 - update to 7.0.8-150500.3.9.1
redis7-debugsource - update to 7.0.8-150500.3.9.1
redis - addressed in versions 7.0.14-1.fc37, 7.0.14-1.fc38, 7.2.2-1.fc39
redis (Debian package) - update to 5:7.0.15-1~deb12u1
dev-db/redis - update to 7.2.4
IBM DataPower Gateway - addressed in versions 10.0.1.17, 10.5.0.9, 10.5.3
Storage Protect Plus Container Agent - update to 10.1.12.7
Juniper Junos Space - update to 24.1R5

• https://github.com/redis/redis/releases/tag/7.2.2
• https://github.com/redis/redis/releases/tag/7.0.14
• https://github.com/redis/redis/releases/tag/6.2.14

• Race condition in Redis
• Fedora 39 update for redis
• Fedora 37 update for redis
• Fedora 38 update for redis
• SUSE update for redis
• SUSE update for redis
• Ubuntu update for redis
• Race condition in Oracle Communications Fraud Monitor
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• SUSE update for redis7
• Multiple vulnerabilities in cPanel EasyApache
• Race condition in IBM DataPower Gateway
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• Multiple vulnerabilities in IBM Storage Protect Plus Container Agent
• Debian update for redis
• Amazon Linux AMI update for redis6
• Amazon Linux AMI update for redis6
• Amazon Linux AMI update for redis6
• Gentoo update for Redis
• openEuler 20.03 LTS SP4 update for redis
• openEuler 22.03 LTS SP3 update for redis
• openEuler 22.03 LTS SP4 update for redis
• openEuler 24.03 LTS update for redis
• openEuler 22.03 LTS SP1 update for redis
• Multiple vulnerabilities in IBM QRadar Assistant
• Red Hat Enterprise Linux 9 update for the redis:7 module
• Red Hat Enterprise Linux 8 update for the redis:6 module
• Red Hat Enterprise Linux 9 update for redis
• Anolis OS update for redis
• Anolis OS update for redis:6 module
• Dell SmartFabric Storage Software update for third-party components
• Multiple vulnerabilities in IBM QRadar Hub
• Multiple vulnerabilities in Junos Space