CVE-2021-32762
📋 TL;DR
This CVE describes an integer overflow vulnerability in Redis' hiredis library that affects redis-cli and redis-sentinel when parsing large multi-bulk network replies. The vulnerability could allow heap memory corruption leading to denial of service or potential remote code execution. Only systems with heap allocators lacking overflow checks are vulnerable, which excludes most modern systems and default redis-sentinel configurations using jemalloc.
💻 Affected Systems
- Redis
- redis-cli
- redis-sentinel
📦 What is this software?
Communications Operations Monitor by Oracle
Communications Operations Monitor by Oracle
Communications Operations Monitor by Oracle
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Management Services For Element Software by Netapp
View all CVEs affecting Management Services For Element Software →
Management Services For Netapp Hci by Netapp
View all CVEs affecting Management Services For Netapp Hci →
Redis by Redis
Redis by Redis
Redis by Redis
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if an attacker can trigger the integer overflow and the system uses a vulnerable heap allocator.
Likely Case
Denial of service through application crash or memory corruption, potentially leading to data loss or service disruption.
If Mitigated
No impact on systems with modern heap allocators (like glibc with overflow checks) or redis-sentinel using default jemalloc allocator.
🎯 Exploit Status
Exploitation requires sending specially crafted large multi-bulk network replies to vulnerable components. The attacker needs network access to redis-cli or redis-sentinel services.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Redis 6.2.6, 6.0.16, or 5.0.14
Vendor Advisory: https://github.com/redis/redis/security/advisories/GHSA-833w-8v3m-8wwr
Restart Required: Yes
Instructions:
1. Identify Redis version using 'redis-server --version'. 2. If version is below patched versions, upgrade to Redis 6.2.6, 6.0.16, or 5.0.14 depending on your major version. 3. Download from https://redis.io/download. 4. Stop Redis services. 5. Install new version. 6. Restart Redis services.
🔧 Temporary Workarounds
Use jemalloc allocator
linuxEnsure redis-sentinel uses jemalloc allocator (default) which is not vulnerable to this issue
redis-sentinel --version | grep 'jemalloc'
Network segmentation
linuxRestrict network access to redis-cli and redis-sentinel services to trusted sources only
iptables -A INPUT -p tcp --dport 6379 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 26379 -s trusted_ip -j ACCEPT
🧯 If You Can't Patch
- Restrict network access to redis-cli and redis-sentinel to only trusted internal networks using firewall rules.
- Monitor for abnormal memory usage or crashes in Redis services and implement alerting for such events.
🔍 How to Verify
Check if Vulnerable:
Check Redis version: 'redis-server --version' or 'redis-cli --version'. If version is below 6.2.6, 6.0.16, or 5.0.14, the system may be vulnerable depending on heap allocator.Check Version:
redis-server --versionVerify Fix Applied:
After patching, verify version is 6.2.6 or higher (for 6.2.x), 6.0.16 or higher (for 6.0.x), or 5.0.14 or higher (for 5.0.x) using 'redis-server --version'.📡 Detection & Monitoring
Log Indicators:
- Redis process crashes or abnormal termination
- Memory allocation errors in system logs
- High memory usage spikes in Redis processes
Network Indicators:
- Unusually large network packets sent to Redis ports (6379, 26379)
- Multiple connection attempts with malformed Redis protocol
SIEM Query:
source="redis.log" AND ("crash" OR "segmentation fault" OR "out of memory")🔗 References
- https://github.com/redis/redis/commit/0215324a66af949be39b34be2d55143232c1cb71
- https://github.com/redis/redis/security/advisories/GHSA-833w-8v3m-8wwr
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/
- https://security.gentoo.org/glsa/202209-17
- https://security.netapp.com/advisory/ntap-20211104-0003/
- https://www.debian.org/security/2021/dsa-5001
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://github.com/redis/redis/commit/0215324a66af949be39b34be2d55143232c1cb71
- https://github.com/redis/redis/security/advisories/GHSA-833w-8v3m-8wwr
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HTYQ5ZF37HNGTZWVNJD3VXP7I6MEEF42/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VL5KXFN3ATM7IIM7Q4O4PWTSRGZ5744Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WR5WKJWXD4D6S3DJCZ56V74ESLTDQRAB/
- https://security.gentoo.org/glsa/202209-17
- https://security.netapp.com/advisory/ntap-20211104-0003/
- https://www.debian.org/security/2021/dsa-5001
- https://www.oracle.com/security-alerts/cpuapr2022.html
