CVE-2021-21309 in Redis
Summary
by MITRE • 02/27/2021
Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer could be exploited to corrupt the heap and potentially result with remote code execution. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. By default, it is 512MB which is a safe value for all platforms. If the limit is significantly increased, receiving a large request from a client may trigger several integer overflow scenarios, which would result with buffer overflow and heap corruption. We believe this could in certain conditions be exploited for remote code execution. By default, authenticated Redis users have access to all configuration parameters and can therefore use the “CONFIG SET proto-max-bulk-len” to change the safe default, making the system vulnerable. **This problem only affects 32-bit Redis (on a 32-bit system, or as a 32-bit executable running on a 64-bit system).** The problem is fixed in version 6.2, and the fix is back ported to 6.0.11 and 5.0.11. Make sure you use one of these versions if you are running 32-bit Redis. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent clients from directly executing `CONFIG SET`: Using Redis 6.0 or newer, ACL configuration can be used to block the command. Using older versions, the `rename-command` configuration directive can be used to rename the command to a random string unknown to users, rendering it inaccessible. Please note that this workaround may have an additional impact on users or operational systems that expect `CONFIG SET` to behave in certain ways.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/14/2021
The vulnerability identified as CVE-2021-21309 represents a critical integer overflow flaw affecting 32-bit installations of Redis version 4.0 and newer. This vulnerability stems from the Redis database's handling of bulk input sizes through the proto-max-bulk-len configuration parameter, which controls the maximum supported bulk input size. The default limit of 512MB is considered safe across all platforms, but when administrators increase this value significantly, the system becomes susceptible to integer overflow conditions that can lead to heap corruption and potentially remote code execution. The flaw specifically impacts 32-bit Redis installations running on either 32-bit systems or as 32-bit executables on 64-bit systems, making it a platform-specific vulnerability rather than a universal threat.
The technical exploitation of this vulnerability occurs through a carefully crafted sequence of operations that leverages the integer overflow in the 32-bit Redis implementation. When the proto-max-bulk-len parameter is modified to an excessively large value, the system's memory management routines can overflow during the processing of large data requests. This overflow creates conditions where buffer overflows occur within the heap memory structure, potentially allowing attackers to manipulate memory layout and execute arbitrary code. The vulnerability's classification aligns with CWE-190, which describes integer overflow and underflow conditions, and the attack pattern maps to ATT&CK technique T1059.007 for command and scripting interpreter, specifically focusing on remote code execution through memory corruption. The vulnerability's exploitation requires an authenticated user with access to the CONFIG SET command, which by default is available to all authenticated Redis users, making it particularly dangerous in environments where user access controls are not properly implemented.
The operational impact of this vulnerability extends beyond simple system compromise, as it can lead to complete system takeover when exploited successfully. Organizations running 32-bit Redis installations face significant risk, particularly those that have increased the proto-max-bulk-len parameter beyond default values for legitimate operational requirements. The vulnerability's exploitation potential is heightened by the fact that Redis installations often run with elevated privileges and may be exposed to untrusted network clients. Additionally, the complexity of modern Redis deployments, which often include multiple interconnected instances and complex configuration setups, can make detection and mitigation more challenging. The vulnerability affects not just individual Redis servers but can potentially compromise entire database clusters when the flaw exists in any component of the system architecture.
Mitigation strategies for CVE-2021-21309 primarily focus on upgrading to patched versions of Redis, with the fix being implemented in version 6.2 and backported to 6.0.11 and 5.0.11. Organizations must ensure they are running one of these patched versions if they operate 32-bit Redis installations. Beyond patching, several workarounds can provide temporary protection while upgrades are planned. The most effective approach involves restricting client access to the CONFIG SET command through Redis's Access Control List (ACL) functionality available in Redis 6.0 and newer versions. For older Redis installations, administrators can utilize the rename-command directive in the redis.conf file to obscure the CONFIG SET command by renaming it to an unpredictable string, effectively preventing unauthorized use while maintaining operational functionality. These mitigation strategies align with security best practices outlined in NIST SP 800-53 and ISO 27001 frameworks, particularly focusing on access control and system hardening measures. Organizations should also implement monitoring for unusual CONFIG SET usage patterns and consider network segmentation to limit exposure of Redis instances to potentially malicious clients. The vulnerability serves as a reminder of the critical importance of proper input validation and memory management in database systems, particularly when dealing with platform-specific constraints and integer size limitations.