Redis Lua Scripting Use-After-Free Vulnerability Leading to Remote Code Execution

A use-after-free vulnerability has been identified in Redis versions with Lua scripting enabled. This issue arises in the master-replica synchronization process, allowing an authenticated attacker to exploit replicas where the 'replica-read-only' setting is disabled or can be disabled. The vulnerability may lead to remote code execution on the affected replicas.

Impact

Exploitation of this vulnerability can result in remote code execution on the affected Redis replica.

Remediation

Users can upgrade to Redis version 8.6.3, where this vulnerability has been patched. Alternatively, avoid using replicas with 'replica-read-only' disabled or prevent users from executing Lua scripts.