#VU97970 Stack-based buffer overflow in Redis - CVE-2024-31449

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing untrusted input. A remote user with ability to influence data input can pass a specially crafted Lua script to the database, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

External links

• https://github.com/redis/redis/releases/tag/7.2.6
• https://github.com/redis/redis/releases/tag/7.4.1
• https://github.com/redis/redis/releases/tag/6.2.16
• https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5