Vulnerabilities > CVE-2021-32761 - Integer Overflow to Buffer Overflow vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

high complexity

NVD

Published: 2021-07-21

Updated: 2023-11-07

Summary

Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves changing the default `proto-max-bulk-len` configuration parameter to a very large value and constructing specially crafted commands bit commands. This problem only affects Redis on 32-bit platforms, or compiled as a 32-bit binary. Redis versions 5.0.`3m 6.0.15, and 6.2.5 contain patches for this issue. An additional workaround to mitigate the problem without patching the `redis-server` executable is to prevent users from modifying the `proto-max-bulk-len` configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.

Vulnerable Configurations

Part	Description	Count
Application	Redislabs Redislabs Redis 6.2.0 Redislabs Redis 6.2.1 Redislabs Redis 6.2.2 Redislabs Redis 6.2.3 Redislabs Redis 6.2.4 Redislabs Redis 6.0 Redislabs Redis 6.0.0 Redislabs Redis 6.0.1 Redislabs Redis 6.0.2 Redislabs Redis 6.0.3 Redislabs Redis 6.0.4 Redislabs Redis 6.0.5 Redislabs Redis 6.0.6 Redislabs Redis 6.0.7 Redislabs Redis 6.0.8 Redislabs Redis 6.0.9 Redislabs Redis 6.0.10 Redislabs Redis 6.0.11 Redislabs Redis 6.0.12 Redislabs Redis 2.2.0 Redislabs Redis 2.2.1 Redislabs Redis 2.2.2 Redislabs Redis 2.2.3 Redislabs Redis 2.2.4 Redislabs Redis 2.2.5 Redislabs Redis 2.2.6 Redislabs Redis 2.2.7 Redislabs Redis 2.2.8 Redislabs Redis 2.2.9 Redislabs Redis 2.2.10 Redislabs Redis 2.2.11 Redislabs Redis 2.2.12 Redislabs Redis 2.2.13 Redislabs Redis 2.2.14 Redislabs Redis 2.2.15 Redislabs Redis 2.2.105 Redislabs Redis 2.2.106 Redislabs Redis 2.2.107 Redislabs Redis 2.2.110 Redislabs Redis 2.2.111 Redislabs Redis 2.3 Redislabs Redis 2.4.0 Redislabs Redis 2.4.1 Redislabs Redis 2.4.2 Redislabs Redis 2.4.3 Redislabs Redis 2.4.4 Redislabs Redis 2.4.5 Redislabs Redis 2.4.6 Redislabs Redis 2.4.7 Redislabs Redis 2.4.8 Redislabs Redis 2.4.9 Redislabs Redis 2.4.10 Redislabs Redis 2.4.11 Redislabs Redis 2.4.12 Redislabs Redis 2.4.13 Redislabs Redis 2.4.14 Redislabs Redis 2.4.15 Redislabs Redis 2.4.16 Redislabs Redis 2.4.17 Redislabs Redis 2.4.18 Redislabs Redis 2.6.0 Redislabs Redis 2.6.1 Redislabs Redis 2.6.2 Redislabs Redis 2.6.3 Redislabs Redis 2.6.4 Redislabs Redis 2.6.5 Redislabs Redis 2.6.6 Redislabs Redis 2.6.7 Redislabs Redis 2.6.7-1 Redislabs Redis 2.6.8 Redislabs Redis 2.6.8-1 Redislabs Redis 2.6.9 Redislabs Redis 2.6.9-1 Redislabs Redis 2.6.10 Redislabs Redis 2.6.10-1 Redislabs Redis 2.6.10-2 Redislabs Redis 2.6.10-3 Redislabs Redis 2.6.11 Redislabs Redis 2.6.12 Redislabs Redis 2.6.13 Redislabs Redis 2.6.14 Redislabs Redis 2.6.14-1 Redislabs Redis 2.6.14-2 Redislabs Redis 2.6.15 Redislabs Redis 2.6.16 Redislabs Redis 2.6.17 Redislabs Redis 2.8.0 Redislabs Redis 2.8.1 Redislabs Redis 2.8.2 Redislabs Redis 2.8.3 Redislabs Redis 2.8.4 Redislabs Redis 2.8.5 Redislabs Redis 2.8.6 Redislabs Redis 2.8.7 Redislabs Redis 2.8.8 Redislabs Redis 2.8.9 Redislabs Redis 2.8.10 Redislabs Redis 2.8.11 Redislabs Redis 2.8.12 Redislabs Redis 2.8.13 Redislabs Redis 2.8.14 Redislabs Redis 2.8.15 Redislabs Redis 2.8.16 Redislabs Redis 2.8.17 Redislabs Redis 2.8.18 Redislabs Redis 2.8.19 Redislabs Redis 2.8.20 Redislabs Redis 2.8.21 Redislabs Redis 2.8.22 Redislabs Redis 2.8.23 Redislabs Redis 2.8.24 Redislabs Redis 3.0 Redislabs Redis 3.0.0 Redislabs Redis 3.0.1 Redislabs Redis 3.0.2 Redislabs Redis 3.0.3 Redislabs Redis 3.0.4 Redislabs Redis 3.0.5 Redislabs Redis 3.0.6 Redislabs Redis 3.0.7 Redislabs Redis 3.2 Redislabs Redis 3.2.0 Redislabs Redis 3.2.1 Redislabs Redis 3.2.2 Redislabs Redis 3.2.3 Redislabs Redis 3.2.4 Redislabs Redis 3.2.5 Redislabs Redis 3.2.6 Redislabs Redis 3.2.7 Redislabs Redis 3.2.8 Redislabs Redis 3.2.9 Redislabs Redis 3.2.10 Redislabs Redis 3.2.11 Redislabs Redis 3.2.12 Redislabs Redis 3.2.13 Redislabs Redis 4.0 Redislabs Redis 4.0.0 Redislabs Redis 4.0.1 Redislabs Redis 4.0.2 Redislabs Redis 4.0.3 Redislabs Redis 4.0.4 Redislabs Redis 4.0.5 Redislabs Redis 4.0.6 Redislabs Redis 4.0.7 Redislabs Redis 4.0.8 Redislabs Redis 4.0.9 Redislabs Redis 4.0.10 Redislabs Redis 4.0.11 Redislabs Redis 4.0.12 Redislabs Redis 4.0.13 Redislabs Redis 4.0.14 Redislabs Redis 5.0 Redislabs Redis 5.0.0 Redislabs Redis 5.0.1 Redislabs Redis 5.0.2 Redislabs Redis 5.0.3 Redislabs Redis 5.0.4 Redislabs Redis 5.0.5 Redislabs Redis 5.0.6 Redislabs Redis 5.0.7 Redislabs Redis 5.0.8 Redislabs Redis 5.0.9 Redislabs Redis 5.0.10 Redislabs Redis 5.0.11 Redislabs Redis 5.0.12	228
OS	Debian Debian Debian Linux 9.0 Debian Debian Linux 10.0 Debian Debian Linux 11.0	3
OS	Fedoraproject Fedoraproject Fedora 33 Fedoraproject Fedora 34	2

Common Weakness Enumeration (CWE)

CWE-680 - Integer Overflow to Buffer Overflow

Common Attack Pattern Enumeration and Classification (CAPEC)

Buffer Overflow via Environment Variables
This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
Overflow Buffers
Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
Client-side Injection-induced Buffer Overflow
This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
Filter Failure through Buffer Overflow
In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
Buffer Overflow via Symbolic Links
This type of attack leverages the use of symbolic links to cause buffer overflows. An attacker can try to create or manipulate a symbolic link file such that its contents result in out of bounds data. When the target software processes the symbolic link file, it could potentially overflow internal buffers with insufficient bounds checking.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References