CVE-2021-31294: Redis DOS Vulnerability via Replica

CVE-2021-31294 Overview

CVE-2021-31294 is a denial of service vulnerability in Redis that allows a replica to cause an assertion failure in a primary server by sending a non-administrative command, specifically a SET command. This vulnerability affects Redis versions before commit 6cbea7d and was addressed in Redis 6.2.x and 7.x releases in 2021. Versions before 6.2 were not intended to have safety guarantees related to this behavior.

Critical Impact

A malicious or compromised replica can crash the primary Redis server by triggering an assertion failure, resulting in denial of service for all clients depending on the Redis instance.

Affected Products

• Redis (versions before 6.2.x)
• Redis (versions before commit 6cbea7d29b5285692843bc1c351abba1a7ef326f)
• Redis (versions before commit 46f4ebbe842620f0976a36741a72482620aa4b48)

Discovery Timeline

• July 15, 2023 - CVE-2021-31294 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-31294

Vulnerability Analysis

This vulnerability is classified under CWE-617 (Reachable Assertion), which occurs when the product contains an assertion that can be triggered by an attacker. In Redis, the primary-replica replication model typically restricts replicas to only sending certain administrative commands to the primary server. However, before the security fix was applied, there was insufficient validation of commands sent by replica connections, allowing replicas to send keyspace-interacting commands such as SET.

When a replica sends a non-administrative command like SET to the primary server, it violates an internal assumption in the codebase, triggering an assertion failure. Assertion failures in C programs typically result in the process being terminated via abort(), causing an immediate crash of the Redis primary server.

Root Cause

The root cause of this vulnerability lies in the insufficient command validation for replica connections in src/server.c. The Redis server did not properly distinguish between read commands and other keyspace-interacting commands when processing requests from replica connections. This allowed replicas to bypass the intended command restrictions and execute operations that should only be permitted from regular client connections.

Attack Vector

The attack requires network access to a Redis primary server from a replica connection. An attacker who has compromised a replica server, or who can establish a malicious replica connection to the primary, can exploit this vulnerability. The attack is executed by:

1. Establishing a replica connection to the target Redis primary server
2. Sending a non-administrative command (such as SET) that interacts with the keyspace
3. The primary server processes the unexpected command and triggers an assertion failure
4. The Redis primary server crashes, causing denial of service

// Security patch from src/server.c - Prevent replicas from sending commands that interact with keyspace (#8868)
         return C_OK;
     }
 
+    int is_read_command = (c->cmd->flags & CMD_READONLY) ||
+                           (c->cmd->proc == execCommand && (c->mstate.cmd_flags & CMD_READONLY));
     int is_write_command = (c->cmd->flags & CMD_WRITE) ||
                            (c->cmd->proc == execCommand && (c->mstate.cmd_flags & CMD_WRITE));
     int is_denyoom_command = (c->cmd->flags & CMD_DENYOOM) ||

Source: GitHub Redis Commit Update

Detection Methods for CVE-2021-31294

Indicators of Compromise

• Unexpected Redis primary server crashes or restarts without apparent cause
• Assertion failure messages in Redis logs from src/server.c
• Unusual SET or other write commands originating from replica connections in audit logs
• Multiple rapid reconnection attempts from replicas following primary crashes

Detection Strategies

• Monitor Redis log files for assertion failure messages and abnormal termination events
• Implement network monitoring to detect non-standard command patterns from replica IP addresses
• Use Redis CLIENT LIST command to audit active replica connections and their command history
• Deploy application-level monitoring to alert on unexpected Redis primary server downtime

Monitoring Recommendations

• Configure alerting for Redis process crashes and unexpected restarts
• Implement replica connection authentication and monitor for unauthorized replica connection attempts
• Enable Redis slow log and command logging to track commands sent by replica connections
• Set up health checks that can detect assertion failures in Redis primary servers

How to Mitigate CVE-2021-31294

Immediate Actions Required

• Upgrade Redis to version 6.2.x or later, which includes the security fix
• Audit all replica connections to ensure they are from trusted sources
• Implement network segmentation to restrict which hosts can establish replica connections
• Enable Redis authentication using requirepass and masterauth directives

Patch Information

The vulnerability was fixed in commits 6cbea7d29b5285692843bc1c351abba1a7ef326f and 46f4ebbe842620f0976a36741a72482620aa4b48. The patch adds proper validation for read commands from replica connections, preventing replicas from sending commands that interact with the keyspace inappropriately. Users should upgrade to Redis 6.2.x or 7.x to receive this fix. Additional information is available in the GitHub Redis Issue Tracker and the NetApp Security Advisory NTAP-20230814-0007.

Workarounds

• Restrict network access to Redis primary servers using firewall rules to allow only trusted replica IPs
• Implement TLS for replica connections to ensure authenticated and encrypted communication
• Monitor replica behavior using Redis monitoring tools and terminate suspicious connections
• Consider deploying Redis Sentinel or Cluster mode with proper authentication for enhanced security

# Configuration example - Redis authentication and network restrictions
# In redis.conf on primary server:
requirepass your_strong_password_here
masterauth your_strong_password_here

# Bind to specific interfaces only
bind 127.0.0.1 10.0.0.1

# Enable TLS for replica connections (Redis 6+)
tls-replication yes
tls-cert-file /path/to/redis.crt
tls-key-file /path/to/redis.key
tls-ca-cert-file /path/to/ca.crt