cbcvebase.
CVE-2021-29477
published 2021-05-04

CVE-2021-29477: Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version…

PriorityP259high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
4.03%
89.3th percentile
Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution. The problem is fixed in version 6.2.3 and 6.0.13. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the `STRALGO LCS` command.

Affected

18 ranges
VendorProductVersion rangeFixed in
debianredis< redis 5:6.0.14-1 (bookworm)redis 5:6.0.14-1 (bookworm)
debianredis< redis 5:6.0.13-1 (bookworm)redis 5:6.0.13-1 (bookworm)
fedoraprojectfedora
fedoraprojectfedora
redisredis< 6.0.146.0.14
redisredis
redisredis>= 0 < 5:6.0.14-15:6.0.14-1
redisredis>= 0 < 5:6.0.13-15:6.0.13-1
redisredis>= 0 < 5:6.0.14-15:6.0.14-1
redisredis>= 0 < 5:6.0.13-15:6.0.13-1
redisredis>= 0 < 5:6.0.14-15:6.0.14-1
redisredis>= 0 < 5:6.0.13-15:6.0.13-1
redisredis>= 0 < 5:6.0.14-15:6.0.14-1
redisredis>= 0 < 5:6.0.13-15:6.0.13-1
redislabsredis>= 6.0.0 < 6.0.136.0.13
redislabsredis>= 6.0.0 < 6.0.146.0.14
redislabsredis>= 6.2.0 < 6.2.36.2.3
redislabsredis>= 6.2.0 < 6.2.46.2.4

Detection & IOCsextracted from sources · hover to see the quote

commandSTRALGO LCS
  • Monitor Redis command logs for use of the STRALGO LCS command, which is the specific attack vector for this integer overflow / heap corruption vulnerability.
  • Restrict or alert on STRALGO LCS command usage via Redis ACL configuration as a detection/mitigation control.
  • ·The proto-max-bulk-len config parameter being >= 2GB is a prerequisite for exploitation on 64-bit systems with the CVE-2021-29477 partial fix applied (versions 6.2.3 or 6.0.13). Ensure this is set below 2GB (default is 512MB) as an additional mitigation.
  • ·Only Redis version 6.0 or newer is vulnerable; Redis 5.x (e.g., redis:5 on RHEL 8) is not affected.
  • ·CVE-2021-29477 fix in versions 6.2.3/6.0.13 was incomplete; the follow-on CVE-2021-32625 requires patching to 6.2.4/6.0.14 for full remediation, particularly on 32-bit systems.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
osv8.8HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.