CVE-2021-32625: Redis Integer Overflow RCE Vulnerability

CVE-2021-32625 Overview

CVE-2021-32625 is an integer overflow vulnerability affecting Redis, the popular open source in-memory data structure store used as a database, cache, and message broker. This vulnerability exists in Redis version 6.0 and newer, where the STRALGO LCS command can be exploited to corrupt the heap and potentially achieve remote code execution.

This vulnerability represents an incomplete fix for CVE-2021-29477, demonstrating how complex integer overflow conditions can persist through initial patching attempts. Authenticated attackers with access to execute Redis commands can leverage this flaw to compromise the integrity and availability of the Redis server.

Critical Impact

Authenticated attackers can exploit the integer overflow in the STRALGO LCS command to corrupt heap memory, potentially leading to remote code execution on vulnerable Redis servers.

Affected Products

• Redis Labs Redis versions 6.0.x prior to 6.0.14
• Redis Labs Redis versions 6.2.x prior to 6.2.4
• Fedora 33 and Fedora 34 (via bundled Redis packages)

Discovery Timeline

• 2021-06-02 - CVE-2021-32625 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-32625

Vulnerability Analysis

This integer overflow vulnerability exists within the STRALGO LCS command implementation in Redis. The Longest Common Subsequence (LCS) algorithm, when processing specially crafted input, can trigger an integer overflow condition that corrupts heap memory. This is particularly dangerous as Redis operates as a memory-intensive application, making heap corruption a viable path to code execution.

The vulnerability is a direct result of an incomplete fix for CVE-2021-29477, which addressed a similar integer overflow issue. The original patch failed to account for all edge cases in the LCS algorithm's memory allocation routines, leaving a window for exploitation on systems running Redis 6.0 or newer.

The attack requires network access and low privileges (authentication to the Redis instance), but once authenticated, exploitation does not require user interaction. A successful exploit can compromise the confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause is an integer overflow condition (CWE-190) that leads to integer overflow to buffer overflow (CWE-680). When the STRALGO LCS command processes input strings, the algorithm calculates buffer sizes for storing intermediate results. Under specific conditions, these calculations can overflow, resulting in an undersized buffer allocation. Subsequent operations then write beyond the allocated buffer boundaries, corrupting the heap.

On 64-bit systems with the CVE-2021-29477 fixes applied (versions 6.2.3 or 6.0.13), the vulnerability can be mitigated by ensuring the proto-max-bulk-len configuration parameter remains smaller than 2GB (the default is 512MB).

Attack Vector

The attack vector is network-based, requiring an authenticated connection to a vulnerable Redis instance. An attacker with valid credentials or access to an unauthenticated Redis deployment can send specially crafted STRALGO LCS commands designed to trigger the integer overflow condition.

The exploitation flow involves:

1. Establishing a connection to the target Redis server
2. Authenticating (if required) with valid credentials
3. Sending a malicious STRALGO LCS command with parameters designed to trigger the integer overflow
4. The overflow causes undersized memory allocation
5. Subsequent write operations corrupt heap metadata
6. Attacker gains potential code execution through controlled heap corruption

The STRALGO LCS command computes the longest common subsequence between strings. By manipulating input parameters to cause integer wraparound during size calculations, an attacker can create a heap overflow condition. For detailed technical analysis, refer to the GitHub Security Advisory GHSA-46cp-x4x9-6pfq.

Detection Methods for CVE-2021-32625

Indicators of Compromise

• Unexpected Redis server crashes or segmentation faults, particularly during string operations
• Abnormal STRALGO LCS command usage in Redis slow logs or command monitoring
• Memory corruption errors or unusual heap allocation patterns in Redis logs
• Unauthorized connections to Redis instances from unexpected source IPs

Detection Strategies

• Monitor Redis command logs for STRALGO LCS command usage, especially with unusually large string parameters
• Implement Redis command auditing using the MONITOR command or redis-cli logging
• Deploy network intrusion detection rules to identify malicious Redis protocol traffic
• Use SentinelOne Singularity platform to detect heap corruption exploitation attempts and anomalous process behavior

Monitoring Recommendations

• Enable Redis slow log monitoring with CONFIG SET slowlog-log-slower-than 10000
• Configure Redis ACLs to restrict STRALGO command access to trusted users only
• Implement real-time monitoring of Redis process memory usage and crash events
• Set up alerts for authentication failures and unexpected connection patterns to Redis ports (default 6379)

How to Mitigate CVE-2021-32625

Immediate Actions Required

• Upgrade Redis to version 6.2.4 or 6.0.14 immediately
• If immediate patching is not possible, use ACL configuration to prevent clients from using the STRALGO LCS command
• On 64-bit systems with CVE-2021-29477 fixes (6.2.3 or 6.0.13), verify that proto-max-bulk-len is smaller than 2GB
• Review and restrict network access to Redis instances using firewall rules
• Audit Redis authentication configurations and enable password protection if not already configured

Patch Information

Redis has released patched versions addressing this vulnerability. Organizations should upgrade to Redis 6.2.4 for the 6.2.x branch or Redis 6.0.14 for the 6.0.x branch. Fedora users should apply updates from the Fedora Package Announcement.

Workarounds

• Use Redis ACL to disable the STRALGO command for all non-essential users: ACL SETUSER default -stralgo
• Set proto-max-bulk-len to a value smaller than 2GB in redis.conf: proto-max-bulk-len 512mb
• Implement network segmentation to restrict Redis access to trusted application servers only
• Enable Redis authentication with a strong password using the requirepass directive

# Configuration example for redis.conf
# Disable STRALGO command using ACL
user default -stralgo on ~* &* +@all

# Set proto-max-bulk-len to default safe value (512MB)
proto-max-bulk-len 512mb

# Enable password authentication
requirepass your_strong_password_here

# Bind to localhost only if remote access is not required
bind 127.0.0.1