Vulnerability · Published Oct 4, 2021 · Assigned by GitHub_M

CVE-2021-32627Integer overflow issue with Streams in Redis

High 7.5

In plain English

A high-severity integer overflow in redis from redis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.0% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)4.0%top 9.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Redis is an open source, in-memory database that persists on disk. In affected versions an integer overflow bug in Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default proto-max-bulk-len and client-query-buffer-limit configuration parameters to very large values and constructing specially crafted very large stream elements. The problem is fixed in Redis 6.2.6, 6.0.16 and 5.0.14. For users unable to upgrade an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	redis	5.0.3-5.module_el8.4.0+2583+b9845322	ALSA-2021:3918
AlmaLinux:8	redis	5.0.3-5.module_el8.5.0+66+fc19ec12	ALSA-2021:3918
AlmaLinux:8	redis	6.0.9-5.module_el8.5.0+67+a3c431d9	ALSA-2021:3945
AlmaLinux:8	redis	6.0.9-5.module_el8.4.0+2584+1bb0d2aa	ALSA-2021:3945
AlmaLinux:8	redis-devel	6.0.9-5.module_el8.4.0+2584+1bb0d2aa	ALSA-2021:3945
AlmaLinux:8	redis-devel	6.0.9-5.module_el8.5.0+67+a3c431d9	ALSA-2021:3945
AlmaLinux:8	redis-devel	5.0.3-5.module_el8.5.0+66+fc19ec12	ALSA-2021:3918
AlmaLinux:8	redis-devel	5.0.3-5.module_el8.4.0+2583+b9845322	ALSA-2021:3918
AlmaLinux:8	redis-doc	5.0.3-5.module_el8.4.0+2583+b9845322	ALSA-2021:3918
AlmaLinux:8	redis-doc	6.0.9-5.module_el8.4.0+2584+1bb0d2aa	ALSA-2021:3945
Alpine:v3.20	redis	6.2.6-r0	ALPINE-CVE-2021-32627
Alpine:v3.21	redis	6.2.6-r0	ALPINE-CVE-2021-32627
Alpine:v3.22	redis	6.2.6-r0	ALPINE-CVE-2021-32627
Alpine:v3.23	redis	6.2.6-r0	ALPINE-CVE-2021-32627
Alpine:v3.24	redis	6.2.6-r0	ALPINE-CVE-2021-32627
Debian:12	redis	5:6.0.16-1	DEBIAN-CVE-2021-32627
Debian:13	redis	5:6.0.16-1	DEBIAN-CVE-2021-32627
Debian:14	redis	5:6.0.16-1	DEBIAN-CVE-2021-32627
Rocky Linux:8	redis	0:6.0.9-5.module+el8.4.0+660+a8447b97	RLSA-2021:3945
Rocky Linux:8	redis	0:6.0.9-5.module+el8.5.0+658+72172854	RLSA-2021:3945
Rocky Linux:8	redis	0:5.0.3-5.module+el8.4.0+659+cf535ef1	RLSA-2021:3918
Rocky Linux:8	redis	0:5.0.3-5.module+el8.5.0+657+2674830e	RLSA-2021:3918

Affected products (as reported)

Vendor	Product	Versions
redis	redis	>= 5.0.0, < 5.0.14>= 6.0.0, < 6.0.16>= 6.2.0, < 6.2.6

Weakness: CWE-190, CWE-680 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/redis/redis/commit/f6a40570fa63d5afdd596c78083d754081d80ae3 x_refsource_MISC
https://github.com/redis/redis/security/advisories/GHSA-f434-69fm-g45v x_refsource_CONFIRM
FEDORA-2021-8913c7900c vendor-advisory, x_refsource_FEDORA
FEDORA-2021-61c487f241 vendor-advisory, x_refsource_FEDORA
FEDORA-2021-aa94492a09 vendor-advisory, x_refsource_FEDORA
DSA-5001 vendor-advisory, x_refsource_DEBIAN
https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
https://security.netapp.com/advisory/ntap-20211104-0003/ x_refsource_CONFIRM
GLSA-202209-17 vendor-advisory, x_refsource_GENTOO