CVE-2024-31449: Redis Lua Scripting RCE Vulnerability

CVE-2024-31449 Overview

Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Critical Impact

This vulnerability may potentially lead to remote code execution, allowing attackers to execute arbitrary code within the Redis environment.

Affected Products

• Redis Redis

Discovery Timeline

• Not Available - Vulnerability discovered by Not Available
• Not Available - Responsible disclosure to redis
• Not Available - CVE CVE-2024-31449 assigned
• Not Available - redis releases security patch
• 2024-10-07 - CVE CVE-2024-31449 published to NVD
• 2025-09-04 - Last updated in NVD database

Technical Details for CVE-2024-31449

Vulnerability Analysis

The vulnerability exploits a stack buffer overflow in the bit library within Lua scripts in Redis. An authenticated attacker can craft a Lua script that takes advantage of this overflow, leading to unauthorized code execution.

Root Cause

The issue arises from improper input validation in the Lua bit library, which mishandles specific script input, leading to overflow conditions.

Attack Vector

The attack can be executed over the network by an authenticated user using crafted Lua scripts in Redis.

-- Example exploitation code (sanitized)
local function overflow_example()
    local str = string.rep("A", 1024)
    return bit.band(0xFFFFFFFF, str)  -- This triggers the vulnerability
end

Detection Methods for CVE-2024-31449

Indicators of Compromise

• Unusual Lua script executions in Redis logs
• Abnormal system behaviors or crashes when executing Lua scripts
• Unexpected termination of Redis service

Detection Strategies

Monitor Redis logs for execution of unexpected or unusually large Lua scripts. Use intrusion detection systems to flag high-risk script patterns that may indicate exploitation attempts.

Monitoring Recommendations

Regularly review access logs and Lua script execution records. Configure monitoring tools to alert on usage of Lua functions associated with buffer manipulation.

How to Mitigate CVE-2024-31449

Immediate Actions Required

• Update Redis to the latest patched versions (6.2.16, 7.2.6, 7.4.1)
• Restrict network access to Redis instances to trusted sources
• Implement robust authentication mechanisms for Redis

Patch Information

Patches are available at the following links:

• Patch
• Vendor Advisory

Workarounds

Not Available

# Configuration example to restrict access
bind 127.0.0.1 ::1                 # Allow only local connections
requirepass myStrongPassword       # Enable password authentication
protected-mode yes                 # Enable protected mode