CVE-2021-21309
Vulnerability from cvelistv5
Published
2021-02-26 21:50
Modified
2024-08-03 18:09
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
Summary
Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the `rename-command` configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect `CONFIG SET` to behave in certain ways.
References
security-advisories@github.comhttps://github.com/redis/redis/commit/c992857618db99776917f10bf4f2345a5fdc78b0Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/redis/redis/pull/8522Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/redis/redis/security/advisories/GHSA-hgj8-vff2-7cjfThird Party Advisory
security-advisories@github.comhttps://security.gentoo.org/glsa/202103-02Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/redis/redis/commit/c992857618db99776917f10bf4f2345a5fdc78b0Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/redis/redis/pull/8522Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/redis/redis/security/advisories/GHSA-hgj8-vff2-7cjfThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202103-02Third Party Advisory
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:09:15.320Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/redis/redis/security/advisories/GHSA-hgj8-vff2-7cjf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/redis/redis/commit/c992857618db99776917f10bf4f2345a5fdc78b0"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/redis/redis/pull/8522"
          },
          {
            "name": "GLSA-202103-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202103-02"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "redis",
          "vendor": "redis",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.0.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.0.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the \u201cCONFIG SET proto-max-bulk-len\u201d to change the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the `rename-command` configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect `CONFIG SET` to behave in certain ways."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-31T13:06:22",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redis/redis/security/advisories/GHSA-hgj8-vff2-7cjf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redis/redis/commit/c992857618db99776917f10bf4f2345a5fdc78b0"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redis/redis/pull/8522"
        },
        {
          "name": "GLSA-202103-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202103-02"
        }
      ],
      "source": {
        "advisory": "GHSA-hgj8-vff2-7cjf",
        "discovery": "UNKNOWN"
      },
      "title": "Integer overflow on 32-bit systems",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-21309",
          "STATE": "PUBLIC",
          "TITLE": "Integer overflow on 32-bit systems"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "redis",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 5.0.11"
                          },
                          {
                            "version_value": "\u003e= 6.0.0, \u003c 6.0.11"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "redis"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the \u201cCONFIG SET proto-max-bulk-len\u201d to change the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the `rename-command` configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect `CONFIG SET` to behave in certain ways."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-190: Integer Overflow or Wraparound"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/redis/redis/security/advisories/GHSA-hgj8-vff2-7cjf",
              "refsource": "CONFIRM",
              "url": "https://github.com/redis/redis/security/advisories/GHSA-hgj8-vff2-7cjf"
            },
            {
              "name": "https://github.com/redis/redis/commit/c992857618db99776917f10bf4f2345a5fdc78b0",
              "refsource": "MISC",
              "url": "https://github.com/redis/redis/commit/c992857618db99776917f10bf4f2345a5fdc78b0"
            },
            {
              "name": "https://github.com/redis/redis/pull/8522",
              "refsource": "MISC",
              "url": "https://github.com/redis/redis/pull/8522"
            },
            {
              "name": "GLSA-202103-02",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202103-02"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-hgj8-vff2-7cjf",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-21309",
    "datePublished": "2021-02-26T21:50:16",
    "dateReserved": "2020-12-22T00:00:00",
    "dateUpdated": "2024-08-03T18:09:15.320Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-21309\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2021-02-26T22:15:19.457\",\"lastModified\":\"2024-11-21T05:47:59.563\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the \u201cCONFIG SET proto-max-bulk-len\u201d to change the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the `rename-command` configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect `CONFIG SET` to behave in certain ways.\"},{\"lang\":\"es\",\"value\":\"Redis es una base de datos en memoria de c\u00f3digo abierto que persiste en el disco.\u0026#xa0;En las versiones afectadas de Redis, un error de desbordamiento de enteros en Redis de 32 bits versi\u00f3n 4.0 o m\u00e1s reciente podr\u00eda ser explotada para corromper la pila y potencialmente resultar en una ejecuci\u00f3n de c\u00f3digo remota.\u0026#xa0;Redis versiones 4.0 o posteriores, usa un l\u00edmite configurable para el tama\u00f1o m\u00e1ximo de la entrada masiva admitida.\u0026#xa0;Por defecto, es de 512 MB, que es un valor seguro para todas las plataformas.\u0026#xa0;Si el l\u00edmite aumenta significativamente, recibir una petici\u00f3n grande de un cliente puede desencadenar varios escenarios de desbordamiento de enteros, que podr\u00eda resultar en un desbordamiento del b\u00fafer y una corrupci\u00f3n de la pila.\u0026#xa0;Creemos que, en determinadas condiciones, esta podr\u00eda ser explotada para una ejecuci\u00f3n de c\u00f3digo remota.\u0026#xa0;Por defecto,  usuarios de Redis autenticados poseen acceso a todos los par\u00e1metros de configuraci\u00f3n y, por lo tanto, pueden usar \\\"CONFIG SET proto-max-bulk-len\\\" para cambiar el valor predeterminado seguro,\u0026#xa0;haciendo que el sistema sea vulnerable.** Este problema solo afecta a Redis de 32 bits (en un sistema de 32 bits o como un ejecutable de 32 bits que se ejecuta en un sistema de 64 bits). ** El problema se corrigi\u00f3 en la versi\u00f3n 6.2 y la soluci\u00f3n se ha modificado a versiones  6.0.11 y 5.0.11.\u0026#xa0;Aseg\u00farese de usar una de estas versiones si est\u00e1 ejecutando Redis de 32 bits.\u0026#xa0;Una soluci\u00f3n alternativa para mitigar el problema sin parchear el ejecutable de redis-server es impedir que los clientes ejecuten directamente `CONFIG SET`: Con Redis versiones 6.0 o m\u00e1s recientes, la configuraci\u00f3n de ACL puede ser usada para bloquear el comando.\u0026#xa0;Utilizando versiones anteriores, la directiva de configuraci\u00f3n \\\"rename-command\\\" puede ser usada para cambiar el nombre del comando a una cadena aleatoria desconocida para usuarios, haci\u00e9ndolo inaccesible.\u0026#xa0;Tome en cuenta que esta soluci\u00f3n puede tener un impacto adicional en los usuarios o los sistemas operativos que esperan que \\\"CONFIG SET\\\" se comporte de determinadas formas\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.2,\"impactScore\":2.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:P/A:P\",\"baseScore\":6.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0\",\"versionEndExcluding\":\"5.0.11\",\"matchCriteriaId\":\"366C8910-66E7-4AB6-873C-70595AD42ADA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redislabs:redis:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"6.0.11\",\"matchCriteriaId\":\"C345BCBB-EB73-4DA5-93F0-42AB9E903CE5\"}]}]}],\"references\":[{\"url\":\"https://github.com/redis/redis/commit/c992857618db99776917f10bf4f2345a5fdc78b0\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/redis/redis/pull/8522\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/redis/redis/security/advisories/GHSA-hgj8-vff2-7cjf\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202103-02\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/redis/redis/commit/c992857618db99776917f10bf4f2345a5fdc78b0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/redis/redis/pull/8522\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/redis/redis/security/advisories/GHSA-hgj8-vff2-7cjf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202103-02\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.