CVE-2022-24834
📋 TL;DR
CVE-2022-24834 is a heap overflow vulnerability in Redis's cjson library that can be triggered via specially crafted Lua scripts. This can lead to heap corruption and potentially remote code execution. Only authenticated and authorized Redis users can exploit this vulnerability.
💻 Affected Systems
- Redis
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Redis by Redis
Redis by Redis
Redis by Redis
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the Redis process, potentially leading to full system compromise.
Likely Case
Redis service crash (denial of service) or limited memory corruption leading to unstable behavior.
If Mitigated
No impact if proper authentication controls prevent unauthorized access or if Lua scripting is disabled.
🎯 Exploit Status
Exploitation requires crafting specific Lua scripts and authenticated access to Redis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.0.12, 6.2.13, or 6.0.20
Vendor Advisory: https://github.com/redis/redis/security/advisories/GHSA-p8x2-9v9q-c838
Restart Required: Yes
Instructions:
1. Stop Redis service. 2. Backup Redis data. 3. Upgrade Redis to patched version. 4. Restart Redis service. 5. Verify version and functionality.
🔧 Temporary Workarounds
Disable Lua scripting
allPrevents execution of Lua scripts that trigger the vulnerability
redis-cli CONFIG SET lua-time-limit 0
Restrict Redis access
allLimit Redis to trusted networks and enforce strong authentication
Configure bind address in redis.conf: bind 127.0.0.1
Set requirepass in redis.conf: requirepass <strong-password>
🧯 If You Can't Patch
- Implement strict network access controls to limit Redis exposure
- Disable Lua scripting functionality entirely
🔍 How to Verify
Check if Vulnerable:
Check Redis version against affected ranges: 2.6 to 7.0.11, ≤6.2.12, ≤6.0.19Check Version:
redis-cli --versionVerify Fix Applied:
Confirm Redis version is 7.0.12, 6.2.13, 6.0.20 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual Lua script execution patterns
- Redis process crashes or abnormal terminations
Network Indicators:
- Suspicious Lua script payloads sent to Redis port 6379
SIEM Query:
source="redis" AND (event="SCRIPT LOAD" OR event="EVAL") AND payload CONTAINS "cjson"🔗 References
- https://github.com/redis/redis/security/advisories/GHSA-p8x2-9v9q-c838
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/
- https://security.netapp.com/advisory/ntap-20230814-0006/
- https://github.com/redis/redis/security/advisories/GHSA-p8x2-9v9q-c838
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIF5MAGYARYUMRFK7PQI7HYXMK2HZE5T/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TDNNH2ONMVNBQ6LUIAOAGDNFPKXNST5K/
- https://security.netapp.com/advisory/ntap-20230814-0006/
