CVE-2024-46981

EUVD-2024-42220

06.01.2025, 22:15

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7 HIGH	LOCAL	HIGH	LOW	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub_M	CNA	7 HIGH	LOCAL	HIGH	LOW	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 98%

Affected Products (NVD)

Vendor	Product	Version
redis	redis	6.2.0 ≤ 𝑥 < 6.2.17
redis	redis	7.2.0 ≤ 𝑥 < 7.2.7
redis	redis	7.4.0 ≤ 𝑥 < 7.4.2
debian	debian_linux	11.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

redict

forky	7.3.6+ds-1 fixed
sid	7.3.6+ds-1 fixed

redis

bookworm	5:7.0.15-1~deb12u5 fixed
bookworm (security)	5:7.0.15-1~deb12u6 fixed
bullseye	vulnerable
bullseye (security)	5:6.0.16-1+deb11u8 fixed
forky	5:8.0.5-1 fixed
sid	5:8.0.5-1 fixed
trixie	5:8.0.2-3+deb13u1 fixed
trixie (security)	5:8.0.2-3+deb13u1 fixed

valkey

forky	8.1.4+dfsg1-1 fixed
sid	8.1.4+dfsg1-1 fixed
trixie	8.1.1+dfsg1-3+deb13u1 fixed
trixie (security)	8.1.1+dfsg1-3+deb13u1 fixed

Ubuntu Releases

Ubuntu Product

Codename

redict

focal	dne
jammy	dne
noble	dne
oracular	ignored
plucky	needs-triage
questing	needs-triage

valkey

focal	dne
jammy	dne
noble	Fixed 7.2.8+dfsg1-0ubuntu0.24.04.2 released
oracular	Fixed 7.2.8+dfsg1-0ubuntu0.24.10.2 released
plucky	needs-triage
questing	needs-triage

redis

bionic	Fixed 5:4.0.9-1ubuntu0.2+esm5 released
focal	Fixed 5:5.0.7-2ubuntu0.1+esm3 released
jammy	Fixed 5:6.0.16-1ubuntu1+esm2 released
noble	Fixed 5:7.0.15-1ubuntu0.24.04.1 released
oracular	Fixed 5:7.0.15-1ubuntu0.24.10.1 released
plucky	needed
questing	not-affected
trusty	Fixed 2:2.8.4-2ubuntu0.2+esm4 released
xenial	Fixed 2:3.0.6-1ubuntu0.4+esm3 released

Known Exploits!

Common Weakness Enumeration

CWE-416 - Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

References

https://github.com/redis/redis/releases/tag/6.2.17

https://github.com/redis/redis/releases/tag/7.2.7

https://github.com/redis/redis/releases/tag/7.4.2

https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c

https://lists.debian.org/debian-lts-announce/2025/01/msg00018.html

https://www.vicarius.io/vsociety/posts/cve-2024-46981-detect-redis-vulnerability

https://www.vicarius.io/vsociety/posts/cve-2024-46981-mitigate-redis-vulnerability