Heap overflow in COMMAND GETKEYS and ACL evaluation in Redis
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.
Summary
Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Several scenarios that may lead to authenticated users executing a specially crafted `COMMAND GETKEYS` or `COMMAND GETKEYSANDFLAGS`and authenticated users who were set with ACL rules that match key names, executing a specially crafted command that refers to a variadic list of key names. The vulnerability is patched in Redis 7.0.12.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Redis | redis | 7.0.0 to before 7.0.12 | 7.0.12 | Patch available | CNA |
- redis VendorRedis Affected 7.0.0 to before 7.0.12 Fixed in 7.0.12 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:* | 7.0.0 to before 7.0.12 | Vulnerable | Redis |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
- cpe:2.3:a:redis:redis:*:*:*:*:*:*:*:* Versions 7.0.0 to before 7.0.12 Vulnerable ·Redis
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA redis (redis) Fixed in 7.0.12
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
Not affected: 11 products
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ansible Automation Platform 1.2
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 17.0
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0
- Red Hat Satellite 6
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2023-36824
References
Advisory 4
- https://github.com/redis/redis/security/advisories/GHSA-4cfx-h9gq-xpx3
- https://lists.fedoraproject.org/archives/list/[email protected]/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/
- https://security.netapp.com/advisory/ntap-20230814-0009/
More Redis vulnerabilities
- TI-2022-00463 Missing authorization in Debian redis KEVCVSS 3.1CRITICAL 10.0
- TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
- TI-2024-20813 Lua library commands may lead to stack overflow and RCE in Redis CVSS 3.1HIGH 8.8
- TI-2022-08647 Heap overflow issue with the Lua cjson library used by Redis CVSS 3.1HIGH 8.8
- TI-2022-08549 Lua scripts can be manipulated to overcome ACL rules in Redis CVSS 3.1HIGH 7.8
- TI-2023-08708 Integer overflow in multiple Redis commands can lead to denial-of-service CVSS 3.1MEDIUM 5.5
Sources
- CVE-2023-36824 · CVE Program
- CVE-2023-36824 · NVD
- FIRST EPSS
- CVE-2023-36824 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences