CVE-2020-14147
📋 TL;DR
This CVE describes an integer overflow vulnerability in Redis's Lua sandbox that allows authenticated users with Lua execution permissions to trigger a stack-based buffer overflow. This can lead to denial of service (crash) or potentially bypass sandbox restrictions. Affects Redis instances where Lua scripting is enabled and users have execution permissions.
💻 Affected Systems
- Redis
📦 What is this software?
Communications Operations Monitor by Oracle
Communications Operations Monitor by Oracle
Communications Operations Monitor by Oracle
Communications Operations Monitor by Oracle
Redis by Redislabs
Redis by Redislabs
⚠️ Risk & Real-World Impact
Worst Case
Memory corruption leading to arbitrary code execution, sandbox escape, and complete system compromise
Likely Case
Denial of service through Redis crash and potential data corruption
If Mitigated
No impact if Lua scripting is disabled or users lack execution permissions
🎯 Exploit Status
Exploitation requires authenticated access with Lua execution permissions. The vulnerability is a regression of CVE-2015-8080.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Redis 6.0.3 and later
Vendor Advisory: https://github.com/redis/redis/releases/tag/6.0.3
Restart Required: Yes
Instructions:
1. Backup Redis data and configuration. 2. Stop Redis service. 3. Upgrade to Redis 6.0.3 or later. 4. Restart Redis service. 5. Verify functionality.
🔧 Temporary Workarounds
Disable Lua scripting
allPrevents exploitation by disabling the vulnerable Lua execution functionality
redis-cli CONFIG SET lua-time-limit 0
redis-cli CONFIG SET user default on nopass ~* &* -@all +ping
Restrict Lua script permissions
allLimit which users can execute Lua scripts to reduce attack surface
redis-cli ACL SETUSER <username> on ><password> ~* &* -@all +ping +eval
🧯 If You Can't Patch
- Implement strict network access controls to limit Redis exposure
- Disable Lua scripting entirely or restrict to trusted users only
🔍 How to Verify
Check if Vulnerable:
Check Redis version and compare against vulnerable range (< 6.0.3)Check Version:
redis-cli --versionVerify Fix Applied:
Confirm Redis version is 6.0.3 or later and test Lua script execution📡 Detection & Monitoring
Log Indicators:
- Redis crash logs
- Unexpected Lua script execution patterns
- Memory corruption errors
Network Indicators:
- Unusual Lua script execution requests
- Multiple failed Lua execution attempts
SIEM Query:
source="redis" AND ("crash" OR "segmentation fault" OR "lua" AND "overflow")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00058.html
- https://github.com/antirez/redis/commit/ef764dde1cca2f25d00686673d1bc89448819571
- https://github.com/antirez/redis/pull/6875
- https://security.gentoo.org/glsa/202008-17
- https://www.debian.org/security/2020/dsa-4731
- https://www.oracle.com/security-alerts/cpujan2021.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00058.html
- https://github.com/antirez/redis/commit/ef764dde1cca2f25d00686673d1bc89448819571
- https://github.com/antirez/redis/pull/6875
- https://security.gentoo.org/glsa/202008-17
- https://www.debian.org/security/2020/dsa-4731
- https://www.oracle.com/security-alerts/cpujan2021.html
