CVE-2022-33105
📋 TL;DR
CVE-2022-33105 is a memory leak vulnerability in Redis v7.0's streamGetEdgeID component that allows attackers to cause denial of service by exhausting system memory. This affects Redis servers running vulnerable versions, particularly those exposed to untrusted clients or processing malicious stream commands.
💻 Affected Systems
- Redis
📦 What is this software?
Redis by Redis
⚠️ Risk & Real-World Impact
Worst Case
Complete system memory exhaustion leading to Redis crash and denial of service, potentially affecting dependent applications and requiring server restart.
Likely Case
Gradual memory consumption increase over time, reducing available system resources and degrading Redis performance until manual intervention is required.
If Mitigated
Minimal impact with proper memory monitoring and resource limits in place, allowing for detection and remediation before service disruption.
🎯 Exploit Status
Exploitation requires sending specific stream commands to Redis, which can be done by any client with access to the Redis server.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Redis 7.0.2 and later
Vendor Advisory: https://github.com/redis/redis/commit/4a7a4e42db8ff757cdf3f4a824f66426036034ef
Restart Required: Yes
Instructions:
1. Download Redis 7.0.2 or later from redis.io. 2. Stop Redis service. 3. Install new version. 4. Start Redis service. 5. Verify version with 'redis-server --version'.
🔧 Temporary Workarounds
Disable Stream Commands
allUse Redis ACL to restrict or disable stream-related commands for untrusted clients
ACL SETUSER untrusteduser -@stream
Memory Limit Configuration
allSet maxmemory and eviction policy to prevent complete memory exhaustion
maxmemory 2gb
maxmemory-policy allkeys-lru
🧯 If You Can't Patch
- Implement strict network access controls to limit Redis exposure to trusted clients only
- Deploy memory monitoring with alerts for abnormal memory consumption patterns
🔍 How to Verify
Check if Vulnerable:
Check Redis version with 'redis-server --version' or 'redis-cli info server | grep redis_version'. If version is 7.0.0 or 7.0.1, system is vulnerable.Check Version:
redis-server --versionVerify Fix Applied:
After patching, verify version is 7.0.2 or later using 'redis-server --version'. Monitor memory usage during normal operations.📡 Detection & Monitoring
Log Indicators:
- Abnormal memory usage patterns in Redis logs
- Frequent memory allocation failures
Network Indicators:
- Unusual volume of XADD, XRANGE, or other stream commands from single sources
SIEM Query:
source="redis.log" AND ("out of memory" OR "OOM" OR memory_usage>90%)🔗 References
- https://github.com/redis/redis/commit/4a7a4e42db8ff757cdf3f4a824f66426036034ef
- https://github.com/redis/redis/pull/10753
- https://github.com/redis/redis/pull/10829
- https://raw.githubusercontent.com/redis/redis/7.0.1/00-RELEASENOTES
- https://security.gentoo.org/glsa/202209-17
- https://security.netapp.com/advisory/ntap-20220729-0005/
- https://github.com/redis/redis/commit/4a7a4e42db8ff757cdf3f4a824f66426036034ef
- https://github.com/redis/redis/pull/10753
- https://github.com/redis/redis/pull/10829
- https://raw.githubusercontent.com/redis/redis/7.0.1/00-RELEASENOTES
- https://security.gentoo.org/glsa/202209-17
- https://security.netapp.com/advisory/ntap-20220729-0005/
