Redis Remote Code Execution Vulnerability via Lua Scripting Manipulation

A critical remote code execution vulnerability has been identified in Redis versions 8.2.1 and prior. This issue allows an authenticated user to execute a specially crafted Lua script that manipulates the garbage collector, triggering a use-after-free condition. The vulnerability exists in all Redis versions that support Lua scripting.

Impact

Exploitation of this vulnerability could lead to unauthorized remote code execution on the server where Redis is running.

Remediation

Users can upgrade to Redis version 8.2.2, which addresses this vulnerability. Alternatively, without patching the Redis server executable, Lua script execution can be disabled by using Access Control Lists (ACLs) to restrict the EVAL and EVALSHA commands.