CVE-2022-0543
📋 TL;DR
CVE-2022-0543 is a critical Lua sandbox escape vulnerability in Redis on Debian-based systems that allows remote attackers to execute arbitrary code. The vulnerability affects Redis installations on Debian, Ubuntu, and other Debian-derived distributions due to a packaging issue. Attackers can exploit this without authentication to gain full control of affected Redis servers.
💻 Affected Systems
- Redis
📦 What is this software?
Redis by Redis
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution leading to data theft, ransomware deployment, lateral movement, and persistent backdoors.
Likely Case
Remote code execution allowing attackers to steal sensitive data, install cryptocurrency miners, or use the server as part of a botnet.
If Mitigated
Limited impact if Redis is properly firewalled, running in a container with limited privileges, and monitored for suspicious Lua script execution.
🎯 Exploit Status
Exploit code is publicly available and trivial to execute. Attackers can send specially crafted Lua scripts via Redis EVAL command to escape the sandbox.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Redis packages with updated Lua library packages (lua5.1 5.1.5-8+deb11u2 for Debian 11, 5.1.5-7.1+deb10u2 for Debian 10)
Vendor Advisory: https://www.debian.org/security/2022/dsa-5081
Restart Required: Yes
Instructions:
1. Update system packages: sudo apt update && sudo apt upgrade
2. Specifically update Redis and Lua packages: sudo apt install --only-upgrade redis-server lua5.1
3. Restart Redis service: sudo systemctl restart redis-server
🔧 Temporary Workarounds
Disable Lua scripting
linuxTemporarily disable Lua script execution in Redis configuration
redis-cli config set lua-time-limit 0
Add 'lua-time-limit 0' to redis.conf and restart
Network isolation
linuxRestrict Redis to localhost or internal network only
Edit redis.conf: bind 127.0.0.1
Configure firewall: sudo ufw deny 6379/tcp
🧯 If You Can't Patch
- Run Redis in a container with minimal privileges and no root access
- Implement strict network access controls and monitor for Lua script execution attempts
🔍 How to Verify
Check if Vulnerable:
Check if Redis is running on Debian/Ubuntu: dpkg -l | grep redis-server && dpkg -l | grep lua5.1Check Version:
redis-server --version && dpkg -l lua5.1Verify Fix Applied:
Verify Lua package version: dpkg -l lua5.1 | grep 5.1.5-8+deb11u2 (for Debian 11) or appropriate patched version📡 Detection & Monitoring
Log Indicators:
- Unusual Lua script execution in Redis logs
- Multiple failed Lua script attempts
- EVAL commands from unexpected sources
Network Indicators:
- EVAL commands containing 'package.loadlib' or 'os.execute'
- Rapid Lua script execution attempts
- Connections from unusual IPs to Redis port 6379
SIEM Query:
source="redis.log" AND "EVAL" AND ("package.loadlib" OR "os.execute" OR "io.popen")🔗 References
- http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html
- https://bugs.debian.org/1005787
- https://lists.debian.org/debian-security-announce/2022/msg00048.html
- https://security.netapp.com/advisory/ntap-20220331-0004/
- https://www.debian.org/security/2022/dsa-5081
- https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce
- http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html
- https://bugs.debian.org/1005787
- https://lists.debian.org/debian-security-announce/2022/msg00048.html
- https://security.netapp.com/advisory/ntap-20220331-0004/
- https://www.debian.org/security/2022/dsa-5081
- https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0543
