CVE-2022-24834 — Heap-based Buffer Overflow in Redis

CWE-122 — Heap-based Buffer OverflowCWE-680 — Integer Overflow to Buffer Overflow12 documents9 sources
Severity
8.8HIGHNVD
NVD7.8
EPSS
42.1%
top 2.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
RedisDebian RedisNI Flexlogger+4 more
Timeline
PublishedJul 13
Latest updateApr 13

Description

Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages9 packages

▶NVDredis/redis2.6.0 — 6.0.20+2
▶debiandebian/redis< redis 5:7.0.15-1~deb12u1 (bookworm)
▶Debianredis/redis< 5:6.0.16-1+deb11u3+3
▶Ubunturedis/redis< 2:2.8.4-2ubuntu0.2+esm3+4

Also affects: Fedora 37, 38

🔴Vulnerability Details

3
GHSA
GHSA-hvf4-7c9q-m9rp: An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834↗2024-07-22
▶
OSV
redis vulnerabilities↗2023-12-05
▶
OSV
CVE-2022-24834: Redis is an in-memory database that persists on disk↗2023-07-13
▶

📋Vendor Advisories

7
Ubuntu
Redis, Lua vulnerabilities↗2026-04-13
▶
CISA ICS
Siemens SCALANCE XCM-/XRM-300↗2024-02-15
▶
Ubuntu
Redis vulnerabilities↗2023-12-05
▶
Oracle
Oracle Oracle Communications Risk Matrix: Install/Upgrade (Redis) — CVE-2022-24834↗2023-10-15
▶
Microsoft
Heap overflow issue with the Lua cjson library used by Redis↗2023-07-11
▶
CVE-2022-24834 — Heap-based Buffer Overflow in Redis | cvebase