PT-2022-2525 · Redis+8 · Redis+8
Published
2022-04-27
·
Updated
2026-05-18
·
CVE-2022-24736
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Redis versions prior to 6.2.7 and 7.0.0
Description
The issue is related to errors in pointer dereferencing. An attacker can exploit this by loading a specially crafted Lua script, causing a NULL pointer dereference that results in a crash of the redis-server process.
Recommendations
For versions prior to 6.2.7 and 7.0.0, update to version 6.2.7 or 7.0.0 to resolve the issue.
As a temporary workaround, if Lua scripting is not being used, consider blocking access to
SCRIPT LOAD and EVAL commands using ACL rules to mitigate the problem without patching the redis-server executable.Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Red Hat
Redis
Rocky Linux
Suse