Redis Unblock Client Flow Use-After-Free Vulnerability Leading to Remote Code Execution

A use-after-free vulnerability has been identified in the unblock client flow of Redis. This issue affects redis-server versions 7.2.0 through 8.6.3. The vulnerability arises because the command processing function does not properly handle errors when re-executing blocked commands. If a blocked client is evicted during this process, an authenticated attacker can exploit the flaw, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability can cause a use-after-free condition, allowing for remote code execution on the affected system.

Remediation

Users can upgrade to Redis version 8.6.3, where this vulnerability has been patched.