CVE-2024-46981
📋 TL;DR
This CVE describes a use-after-free vulnerability in Redis where an authenticated user can craft a malicious Lua script to manipulate the garbage collector, potentially leading to remote code execution. The vulnerability affects Redis versions before 6.2.17, 7.2.7, and 7.4.2. Organizations running vulnerable Redis instances with authenticated user access are at risk.
💻 Affected Systems
- Redis
📦 What is this software?
Redis by Redis
Redis by Redis
Redis by Redis
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution with the privileges of the Redis process, potentially leading to complete system compromise, data theft, or lateral movement.
Likely Case
Denial of service through Redis process crashes or instability, with potential for limited code execution in constrained environments.
If Mitigated
No impact if proper access controls prevent Lua script execution or if the system is patched.
🎯 Exploit Status
Exploitation requires authenticated access and crafting of specific Lua scripts to trigger the use-after-free condition. No public exploit code is known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.17, 7.2.7, or 7.4.2
Vendor Advisory: https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c
Restart Required: No
Instructions:
1. Identify your Redis version. 2. Upgrade to Redis 6.2.17, 7.2.7, or 7.4.2 using your package manager or from source. 3. Verify the upgrade was successful. No restart is required for hot patching in some configurations, but a restart ensures clean state.
🔧 Temporary Workarounds
Disable Lua Script Execution via ACL
allPrevent users from executing EVAL and EVALSHA commands using Redis Access Control Lists (ACL).
ACL SETUSER <username> -@all +@read +@write -eval -evalsha
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Redis instances from untrusted networks.
- Enforce strong authentication and limit user privileges to only necessary commands using ACLs.
🔍 How to Verify
Check if Vulnerable:
Check Redis version; if below 6.2.17, 7.2.7, or 7.4.2, it is vulnerable. Also verify if authenticated users can execute Lua scripts.Check Version:
redis-cli --version or redis-server --versionVerify Fix Applied:
Confirm Redis version is 6.2.17, 7.2.7, or 7.4.2 or higher. Test that Lua script execution is blocked if workaround is applied.📡 Detection & Monitoring
Log Indicators:
- Unusual Lua script execution patterns, especially from unexpected users or IPs.
- Redis process crashes or abnormal termination logs.
Network Indicators:
- Multiple EVAL or EVALSHA commands from a single source in short timeframes.
- Network traffic to Redis port 6379 from unauthorized sources.
SIEM Query:
source="redis" AND (command="EVAL" OR command="EVALSHA") | stats count by src_ip, user🔗 References
- https://github.com/redis/redis/releases/tag/6.2.17
- https://github.com/redis/redis/releases/tag/7.2.7
- https://github.com/redis/redis/releases/tag/7.4.2
- https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c
- https://lists.debian.org/debian-lts-announce/2025/01/msg00018.html
- https://www.vicarius.io/vsociety/posts/cve-2024-46981-detect-redis-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2024-46981-mitigate-redis-vulnerability
