Redis HyperLogLog Out-of-Bounds Write Vulnerability Leading to Remote Code Execution

A vulnerability exists in Redis versions 2.8 prior to 8.0.3, as well as in versions 7.4.5, 7.2.10, and 6.2.19. This vulnerability allows an authenticated user to trigger a stack and heap out-of-bounds write during HyperLogLog operations, potentially leading to remote code execution. The issue likely affects all Redis versions that include HyperLogLog functionality.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Redis is running.

Reproduction

The vulnerability can be reproduced by an authenticated user who sends a specially crafted string that exploits the HyperLogLog commands. This can be done by manipulating the sparse representation of a HyperLogLog object to include opcodes that cause an out-of-bounds write.

Remediation

Users can upgrade to Redis versions 8.0.3, 7.4.5, 7.2.10, or 6.2.19. Alternatively, HyperLogLog operations can be disabled for users by using Access Control Lists (ACLs) to restrict these commands.