PT-2022-1643 · Redis+4 · Redis+4
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Redis versions prior to the fixed version
Debian-specific Redis Server (affected versions not specified)
Description
A Lua sandbox escape vulnerability in Redis could result in remote code execution. The issue is related to a packaging problem and is specific to Debian. It is estimated that around 40,000 out of 360,000 Redis instances are unprotected, with some being vulnerable to this issue. The vulnerability has been exploited in real-world attacks, including by the P2PInfect malware, which targets IoT devices and employs evasion methods. The malware uses the vulnerability to escape the Lua sandbox and execute arbitrary code, then establishes a peer-to-peer connection with a larger network and downloads additional malicious binaries.
Recommendations
For Redis versions prior to the fixed version, update to the latest version to mitigate the risk.
As a temporary workaround, consider disabling the
eval() function until a patch is available.
Restrict access to the Redis server to minimize the risk of exploitation.
Set strong passwords and keep the software up to date.
Avoid using the vulnerable Lua sandbox until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
RCE
Missing Authorization
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Debian-Specific Redis Server
Linuxmint
Redis
Ubuntu