CVE-2025-27151 in Redis
Summary
by MITRE • 05/29/2025
Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer overflow exists in redis-check-aof due to the use of memcpy with strlen(filepath) when copying a user-supplied file path into a fixed-size stack buffer. This allows an attacker to overflow the stack and potentially achieve code execution. This issue has been patched in version 8.0.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2025
The vulnerability identified as CVE-2025-27151 affects Redis versions from 7.0.0 through 8.0.1, specifically targeting the redis-check-aof utility which is used to validate append-only files in the Redis database system. This issue represents a critical stack-based buffer overflow that arises from improper memory management during file path processing. The vulnerability occurs when the utility handles user-supplied file paths, creating a potential attack vector that could allow remote code execution. The affected component redis-check-aof is part of Redis's administrative toolset designed for database integrity verification, making this a particularly concerning flaw as it could be exploited during routine database maintenance operations.
The technical flaw stems from the use of memcpy function with strlen(filepath) as the copy length parameter when transferring a user-provided file path into a fixed-size stack buffer. This pattern creates a classic buffer overflow condition where the amount of data copied is not properly validated against the buffer capacity. The vulnerability is categorized under CWE-121 Stack-based Buffer Overflow, which is classified as a high-severity issue in the Common Weakness Enumeration catalog. When an attacker provides a sufficiently long file path, the memcpy operation will overwrite adjacent stack memory, potentially corrupting the return address and other critical execution context. This memory corruption could enable an attacker to redirect program execution flow and ultimately achieve arbitrary code execution on the system running the vulnerable Redis instance.
The operational impact of this vulnerability extends beyond simple code execution as it affects the fundamental integrity of Redis database operations. Since redis-check-aof is typically used during database recovery and maintenance scenarios, an attacker could exploit this during routine operations to gain unauthorized access to the system. The vulnerability is particularly dangerous because it requires no authentication to exploit, making it a remote code execution vulnerability. The attack surface is broadened by the fact that Redis installations are often deployed in production environments where administrative tools may be executed with elevated privileges. According to ATT&CK framework, this vulnerability maps to T1059.007 Command and Scripting Interpreter: Python and T1203 Exploitation for Client Execution, as it enables attackers to execute arbitrary code through the compromised administrative utility. The vulnerability affects systems where Redis is configured to use append-only files for persistence, which is the default configuration for most Redis deployments.
Mitigation strategies for CVE-2025-27151 primarily focus on immediate version upgrades to Redis 8.0.2 or later, which contains the necessary patches to address the buffer overflow condition. Organizations should also implement network segmentation and access controls to limit exposure of Redis instances to untrusted networks, as this vulnerability can be exploited remotely. Additional defensive measures include disabling the redis-check-aof utility when it is not actively needed, implementing strict input validation for file paths, and monitoring for unusual file access patterns that might indicate exploitation attempts. System administrators should also consider implementing runtime protections such as stack canaries and address space layout randomization to make exploitation more difficult. The fix implemented in Redis 8.0.2 addresses the root cause by properly validating the input length before performing memory operations, ensuring that memcpy is called with appropriate bounds checking to prevent stack buffer overflows. Security teams should conduct comprehensive vulnerability assessments across all Redis installations to identify and remediate affected systems promptly.