CVE-2024-55656 Overview
CVE-2024-55656 is an integer overflow vulnerability in RedisBloom, a Redis module that adds probabilistic data structures such as Bloom filters and Count-Min Sketches. The flaw resides in the CMS.INITBYDIM command, which initializes a Count-Min Sketch using attacker-controlled width and depth values. An authenticated Redis client can supply values that wrap around during multiplication inside NewCMSketch(), causing the module to allocate a heap buffer smaller than expected. Subsequent reads and writes exceed the allocation, resulting in information disclosure and out-of-bounds write primitives on the Redis server process. The issue is tracked as [CWE-190] Integer Overflow or Wraparound.
Critical Impact
An authenticated Redis client can trigger heap out-of-bounds read and write in RedisBloom, leading to information disclosure and potential code execution in the Redis server process.
Affected Products
- RedisBloom versions prior to 2.2.19 (2.2.x branch)
- RedisBloom versions prior to 2.4.12 (2.4.x branch)
- RedisBloom versions prior to 2.6.14 (2.6.x branch) and prior to 2.8.2 (2.8.x branch)
Discovery Timeline
- 2025-01-08 - CVE-2024-55656 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-55656
Vulnerability Analysis
RedisBloom implements the Count-Min Sketch probabilistic data structure through the CMS.INITBYDIM command. The command accepts two user-controlled integers, width and depth, and passes them to NewCMSketch() to compute the size of the heap buffer that will store sketch counters. The size calculation multiplies these values without validating that the product fits into the target integer type. When the multiplication wraps around, the allocator returns a buffer far smaller than the sketch logically requires.
After allocation, RedisBloom continues to treat the buffer as if it had the full width * depth capacity. Increment and query operations on the sketch then index outside the allocated region. This yields both an out-of-bounds read primitive, useful for leaking adjacent heap contents, and an out-of-bounds write primitive that corrupts neighboring heap metadata or objects.
Exploitation requires network access to Redis and knowledge of the authentication password, so the attack surface is limited to authenticated clients. In shared or multi-tenant Redis deployments, this still represents a meaningful escalation path from a low-privilege database user to control over the Redis server process.
Root Cause
The root cause is missing bounds checking on the arithmetic used to compute the allocation size in NewCMSketch(). RedisBloom trusts the client-supplied width and depth arguments to CMS.INITBYDIM and does not verify that their product remains within the representable range of the size type before calling the memory allocator.
Attack Vector
The vulnerability manifests when an authenticated client issues a crafted CMS.INITBYDIM command with width and depth values whose product overflows. Subsequent CMS.INCRBY or CMS.QUERY operations on the undersized sketch drive the out-of-bounds access. See the RedisBloom GitHub Security Advisory for authoritative technical details.
Detection Methods for CVE-2024-55656
Indicators of Compromise
- Unexpected CMS.INITBYDIM commands in Redis command logs with unusually large width or depth arguments, particularly values close to integer type boundaries.
- Redis server crashes, segmentation faults, or heap corruption traces originating in the RedisBloom module (redisbloom.so).
- Anomalous memory growth or aborted client connections following RedisBloom command activity.
Detection Strategies
- Enable Redis command auditing with MONITOR or slowlog in non-production tiers and alert on CMS.INITBYDIM invocations with arguments exceeding sane sketch dimensions.
- Inventory loaded Redis modules using MODULE LIST and flag hosts running RedisBloom versions below 2.2.19, 2.4.12, 2.6.14, or 2.8.2.
- Correlate Redis process crashes with preceding CMS.* command activity from the same client session.
Monitoring Recommendations
- Forward Redis server logs and audit events to a centralized analytics platform and build alerts for RedisBloom command anomalies.
- Monitor authentication events on Redis instances and treat credential exposure as a prerequisite risk indicator for this CVE.
- Track outbound network activity from Redis hosts to identify post-exploitation data exfiltration if out-of-bounds reads are used to leak memory.
How to Mitigate CVE-2024-55656
Immediate Actions Required
- Upgrade RedisBloom to a fixed release: 2.2.19, 2.4.12, 2.6.14, or 2.8.2, matching the branch currently deployed.
- Rotate Redis authentication credentials and restrict requirepass or ACL access to trusted application identities only.
- Restrict network exposure of Redis instances using firewall rules, VPC security groups, or bind directives so only application hosts can reach the service.
Patch Information
The RedisBloom maintainers fixed the integer overflow in versions 2.2.19, 2.4.12, 2.6.14, and 2.8.2. Operators should replace the redisbloom.so module with a build from one of these releases and restart the Redis server. Refer to the RedisBloom GitHub Security Advisory GHSA-x5rx-rmq3-ff3h for release artifacts.
Workarounds
- If patching is not immediately possible, unload the RedisBloom module with MODULE UNLOAD bf on instances that do not require probabilistic data structures.
- Use Redis Access Control Lists to deny CMS.INITBYDIM and other CMS.* commands to untrusted users via ACL SETUSER <user> -CMS.INITBYDIM.
- Isolate multi-tenant Redis deployments so that clients holding the password cannot reach production data stores.
# Example Redis ACL restricting access to CMS.INITBYDIM
ACL SETUSER appuser on >StrongPasswordHere ~* +@read +@write -CMS.INITBYDIM -CMS.INCRBY -CMS.QUERY
# Verify RedisBloom module version
redis-cli MODULE LIST
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
