CVE-2023-28856 Overview
CVE-2023-28856 is a denial-of-service vulnerability in Redis, an open-source in-memory database. Authenticated users can issue the HINCRBYFLOAT command to create an invalid hash field. Subsequent access to that field crashes the Redis server process. The flaw affects Redis versions prior to 7.0.11, 6.2.12, and 6.0.19. The issue is tracked under [CWE-20] (Improper Input Validation) and [CWE-617] (Reachable Assertion).
Critical Impact
An authenticated attacker with command access can persistently crash Redis on every restart by poisoning a hash with an invalid field, resulting in service-wide denial of service.
Affected Products
- Redis versions prior to 6.0.19, 6.2.12, and 7.0.11
- Debian Linux 10 (Buster) Redis packages
- Fedora 36, 37, and 38 Redis packages
Discovery Timeline
- 2023-04-18 - CVE-2023-28856 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2023-28856
Vulnerability Analysis
The vulnerability resides in Redis's handling of the HINCRBYFLOAT command. This command atomically increments a float value stored in a hash field. The implementation fails to validate the resulting value against Redis's internal invariants for hash field representation. When an attacker crafts an input that produces a value such as NaN or otherwise malformed float, Redis stores an invalid field within the hash data structure.
The damage occurs at access time rather than write time. Any subsequent command that reads, iterates, or serializes the poisoned hash field triggers a reachable assertion or invalid state, terminating the Redis process. Because Redis persists data through AOF or RDB snapshots, the invalid field survives restarts. The server may enter a crash loop whenever the persisted dataset is reloaded and the corrupt field is touched.
Root Cause
The root cause is improper input validation [CWE-20] in the HINCRBYFLOAT command path. Redis does not reject or sanitize float increments that yield non-representable hash field values. The condition violates an internal assertion [CWE-617], converting bad data into an availability failure. The upstream fix in commit bc7fe41e5857a0854d524e2a63a028e9394d2a5c adds validation so that operations producing invalid floats return an error to the client rather than corrupting the hash.
Attack Vector
Exploitation requires network access to the Redis instance and authenticated credentials with permission to execute hash commands. The attacker issues a single HINCRBYFLOAT against a target hash field with a value that produces an invalid float. Any client subsequently touching that field crashes the server. In environments where Redis is exposed to application tenants or used in multi-tenant caches, a low-privileged user can take down the database for all consumers. Refer to the GitHub Security Advisory for additional technical details.
Detection Methods for CVE-2023-28856
Indicators of Compromise
- Redis process termination accompanied by assertion failure messages in the server log referencing hash or float handling.
- Repeated Redis restarts triggered by access to a specific hash key.
- Unexpected HINCRBYFLOAT commands originating from low-privilege application accounts in the Redis MONITOR or slowlog output.
Detection Strategies
- Inspect Redis server logs for assertion panics that occur immediately after hash field reads.
- Audit command history with redis-cli MONITOR or ACL log entries for HINCRBYFLOAT calls with unusual numeric arguments such as values producing nan or inf.
- Correlate client crash reports of HGET, HGETALL, or HSCAN errors against the same hash key as a signal of a poisoned field.
Monitoring Recommendations
- Track Redis uptime and crash counters in your observability platform and alert on unexpected restarts.
- Forward Redis logs to a centralized SIEM and write detection rules for assertion strings emitted by the affected code paths.
- Monitor authenticated Redis sessions for anomalous use of mutation commands by accounts that normally only issue reads.
How to Mitigate CVE-2023-28856
Immediate Actions Required
- Upgrade Redis to version 7.0.11, 6.2.12, or 6.0.19 or later on all affected instances.
- Apply distribution updates from the Debian LTS announcement and the Fedora package announcement.
- Review and tighten Redis ACLs so that only required application identities can execute HINCRBYFLOAT.
- Audit persisted RDB and AOF files for poisoned hash fields if a crash loop is observed after upgrade.
Patch Information
The fix is delivered in upstream commit bc7fe41e5857a0854d524e2a63a028e9394d2a5c and merged via pull request 11149. Fixed releases are Redis 7.0.11, 6.2.12, and 6.0.19. NetApp customers should consult the NetApp Security Advisory for product-specific guidance.
Workarounds
- No vendor-supplied workaround exists; the Redis security advisory states upgrading is required.
- As a compensating control, restrict network exposure of Redis to trusted application subnets and require strong authentication.
- Use Redis ACLs to remove HINCRBYFLOAT from command sets granted to untrusted or shared-tenant users until patching is complete.
# Configuration example: restrict HINCRBYFLOAT via Redis ACL
# Replace appuser and password as appropriate for your environment
ACL SETUSER appuser on >StrongPasswordHere ~* +@read +@write -hincrbyfloat
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
