Vulnerability · Published Oct 4, 2021 · Assigned by GitHub_M
CVE-2021-32687Integer overflow issue with intsets in Redis
High 7.5
In plain English
A high-severity integer overflow in redis from redis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.1% (higher than 91% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Redis can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution. The vulnerability involves changing the default set-max-intset-entries configuration parameter to a very large value and constructing specially crafted commands to manipulate sets. The problem is fixed in Redis versions 6.2.6, 6.0.16 and 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the set-max-intset-entries configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | redis | 5.0.3-5.module_el8.4.0+2583+b9845322 | ALSA-2021:3918 |
| AlmaLinux:8 | redis | 5.0.3-5.module_el8.5.0+66+fc19ec12 | ALSA-2021:3918 |
| AlmaLinux:8 | redis | 6.0.9-5.module_el8.5.0+67+a3c431d9 | ALSA-2021:3945 |
| AlmaLinux:8 | redis | 6.0.9-5.module_el8.4.0+2584+1bb0d2aa | ALSA-2021:3945 |
| AlmaLinux:8 | redis-devel | 6.0.9-5.module_el8.4.0+2584+1bb0d2aa | ALSA-2021:3945 |
| AlmaLinux:8 | redis-devel | 6.0.9-5.module_el8.5.0+67+a3c431d9 | ALSA-2021:3945 |
| AlmaLinux:8 | redis-devel | 5.0.3-5.module_el8.5.0+66+fc19ec12 | ALSA-2021:3918 |
| AlmaLinux:8 | redis-devel | 5.0.3-5.module_el8.4.0+2583+b9845322 | ALSA-2021:3918 |
| AlmaLinux:8 | redis-doc | 5.0.3-5.module_el8.4.0+2583+b9845322 | ALSA-2021:3918 |
| AlmaLinux:8 | redis-doc | 6.0.9-5.module_el8.4.0+2584+1bb0d2aa | ALSA-2021:3945 |
| Alpine:v3.20 | redis | 6.2.6-r0 | ALPINE-CVE-2021-32687 |
| Alpine:v3.21 | redis | 6.2.6-r0 | ALPINE-CVE-2021-32687 |
| Alpine:v3.22 | redis | 6.2.6-r0 | ALPINE-CVE-2021-32687 |
| Alpine:v3.23 | redis | 6.2.6-r0 | ALPINE-CVE-2021-32687 |
| Alpine:v3.24 | redis | 6.2.6-r0 | ALPINE-CVE-2021-32687 |
| Debian:12 | redis | 5:6.0.16-1 | DEBIAN-CVE-2021-32687 |
| Debian:13 | redis | 5:6.0.16-1 | DEBIAN-CVE-2021-32687 |
| Debian:14 | redis | 5:6.0.16-1 | DEBIAN-CVE-2021-32687 |
| Rocky Linux:8 | redis | 0:6.0.9-5.module+el8.4.0+660+a8447b97 | RLSA-2021:3945 |
| Rocky Linux:8 | redis | 0:6.0.9-5.module+el8.5.0+658+72172854 | RLSA-2021:3945 |
| Rocky Linux:8 | redis | 0:5.0.3-5.module+el8.4.0+659+cf535ef1 | RLSA-2021:3918 |
| Rocky Linux:8 | redis | 0:5.0.3-5.module+el8.5.0+657+2674830e | RLSA-2021:3918 |
Affected products (as reported)
Weakness: CWE-190, CWE-680 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/redis/redis/security/advisories/GHSA-m3mf-8x9w-r27q x_refsource_CONFIRM
- https://github.com/redis/redis/commit/a30d367a71b7017581cf1ca104242a3c644dec0f x_refsource_MISC
- FEDORA-2021-8913c7900c vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-61c487f241 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-aa94492a09 vendor-advisory, x_refsource_FEDORA
- DSA-5001 vendor-advisory, x_refsource_DEBIAN
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20211104-0003/ x_refsource_CONFIRM
- GLSA-202209-17 vendor-advisory, x_refsource_GENTOO