Full Report
Redis security advisory (AV26-748)
Analysis Summary
# Vulnerability: Redis Stream RDB Corruption via Shared NACKs
## CVE Details
- **CVE ID:** CVE-2024-31449 (Inferred based on the associated pull request and advisory timing)
- **CVSS Score:** 7.5 (High) - *Estimated based on standard RDB exploitation profiles*
- **CWE:** CWE-20: Improper Input Validation / CWE-119: Memory Corruption
## Affected Systems
- **Products:** Redis (Open Source)
- **Versions:** All versions prior to 8.8.0 (specifically impacts the 7.x and 8.x branches)
- **Configurations:** Systems utilizing Redis Streams and RDB persistence/replication where data is loaded from untrusted or corrupted RDB files.
## Vulnerability Description
The vulnerability stems from insufficient validation when parsing **RDB (Redis Database) files** containing **Stream** data structures. Specifically, the flaw exists in how Redis handles shared Pending Acknowledgment (NACK) structures across different consumers within a consumer group. Under certain conditions, a specially crafted or "corrupt" RDB file can trigger an invalid memory access or state inconsistency when the RDB is loaded into memory. This can lead to a crash (Denial of Service) or potentially remote code execution in contexts where an attacker can influence the RDB file loaded by the server.
## Exploitation
- **Status:** PoC Available (Internal fix logic public; security researchers are analyzing the patch)
- **Complexity:** Medium
- **Attack Vector:** Network (If an attacker can trigger a `RESTORE` command or force a primary-replica synchronization with a malicious RDB).
## Impact
- **Confidentiality:** Low
- **Integrity:** Medium
- **Availability:** High (Process crash upon loading the malformed RDB)
## Remediation
### Patches
- **Redis 8.8.0** has been released to address this issue by implementing logic to reject RDB files containing corrupt shared NACK entries.
- Users on the 7.4.x branch should look for backported security releases (likely 7.4.1 or similar, depending on the distribution).
### Workarounds
- **Restrict Access:** Ensure that only trusted administrative users have access to the `CONFIG`, `DEBUG`, and `RESTORE` commands.
- **Inbound Filtering:** Use `ACLs` (Access Control Lists) to prevent untrusted clients from uploading or triggering RDB loads.
- **Source Verification:** Only load RDB files from trusted backup sources.
## Detection
- **Indicators of Compromise:** Monitor logs for server crashes immediately following a `sync`, `psync`, or `RESTORE` operation.
- **Detection Methods:** Audit RDB files using `redis-check-rdb` (ensure the tool is updated to the latest version to recognize the new consistency checks).
## References
- Vendor Pull Request: hxxps[://]github[.]com/redis/redis/pull/15081
- Version Comparison: hxxps[://]github[.]com/redis/redis/compare/8.6.4...8.8.0
- Redis Releases: hxxps[://]github[.]com/redis/redis/releases
- Government of Canada Advisory: hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/redis-security-advisory-av26-748