Redis is a popular in-memory database that persists data on the disk, providing a fast, efficient, and flexible solution for various use cases across a wide range of industries. However, like any software, Redis is not immune to vulnerabilities. In this article, we'll take a close look at the recently discovered CVE-2022-24736 security vulnerability in Redis, examine the root cause, discuss the impact and potential exploit details, and provide solutions to fix or mitigate the issue.

Background

Before diving into the CVE-2022-24736 vulnerability, it's essential to understand that Redis supports Lua scripting, allowing users to perform operations on the server-side, enhancing Redis' functionality and performance. This script-loading feature is accessible via SCRIPT LOAD and EVAL commands.

The Vulnerability: CVE-2022-24736
This vulnerability, officially referred to as CVE-2022-24736, affects Redis versions prior to 6.2.7 and 7... The vulnerability stems from a NULL pointer dereference issue when attempting to load a specifically crafted Lua script. Loading this malicious script can cause the redis-server process to crash, effectively leading to a denial of service (DoS) attack, which impacts the availability of the Redis database.

Exploit Details

An attacker with access to the Redis instance can exploit this vulnerability by crafting a malicious Lua script that will trigger the NULL pointer dereference, resulting in a crash of the redis-server process. The attacker could potentially execute the attack by running the following command:

redis-cli EVAL "<malicious_lua_script>"

It is worth mentioning that the attacker would need prior knowledge and access to the Redis instance, and the Lua script must be crafted in a way to exploit this specific vulnerability.

Fixing the Issue

The most straightforward solution to address this vulnerability is simply to update Redis to version 6.2.7 or 7.., which includes the necessary fixes. To do this, follow the official Redis upgrade guide: https://redis.io/topics/upgrade

Mitigating the Problem

If your organization cannot immediately upgrade the Redis instance for any reason, you can implement a workaround to mitigate the risk of this vulnerability by using Access Control Lists (ACLs). With ACLs, you can block access to the SCRIPT LOAD and EVAL commands, preventing attackers from loading malicious Lua scripts.

Add the following ACL rule

user default on +@all -scripting # Blocks 'SCRIPT LOAD' and 'EVAL' commands for default user

Restart the redis-server process for changes to take effect

redis-cli SHUTDOWN
redis-server /path/to/redis.conf

By following these steps, you'll effectively block access to the vulnerable commands, mitigating the risk associated with CVE-2022-24736.

Conclusion

As a Redis user or administrator, it's important to understand the security implications and potential risks associated with CVE-2022-24736. Updating to Redis versions 6.2.7 or 7.. is the most effective way to fix the vulnerability, while implementing ACL rules can serve as a temporary workaround if immediate updates are not possible. Always ensure that you keep your software up-to-date to protect against security vulnerabilities and maintain the stability and integrity of your Redis infrastructure.

Timeline

Published on: 04/27/2022 20:15:00 UTC
Last modified on: 07/25/2022 18:22:00 UTC