CVE-2024-55656 Overview
CVE-2024-55656 is an integer overflow vulnerability [CWE-190] in RedisBloom, a module that adds probabilistic data structures to Redis. The flaw resides in the CMS.INITBYDIM command, which initializes a Count-Min Sketch using user-supplied width and depth values. During memory allocation in NewCMSketch(), the product of these values wraps around, causing the heap allocation to be smaller than expected.
An authenticated Redis client can trigger the overflow and force subsequent reads and writes beyond the allocated buffer. This enables information disclosure and out-of-bounds writes on the Redis server heap.
Critical Impact
An authenticated attacker can achieve heap out-of-bounds read and write in the Redis process, leading to information disclosure, memory corruption, and potential remote code execution.
Affected Products
- RedisBloom versions prior to 2.2.19 (2.2.x branch)
- RedisBloom versions prior to 2.4.12 (2.4.x branch)
- RedisBloom versions prior to 2.6.14 (2.6.x branch) and prior to 2.8.2 (2.8.x branch)
Discovery Timeline
- 2025-01-08 - CVE-2024-55656 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-55656
Vulnerability Analysis
RedisBloom exposes probabilistic data structures through Redis commands. The CMS.INITBYDIM command creates a Count-Min Sketch with dimensions specified by the client. The module multiplies the width and depth arguments to compute the size of the counter array before allocating heap memory in NewCMSketch().
When an attacker supplies large values, the multiplication overflows the fixed-width integer used to hold the result. The overflow produces a small value that is passed to the allocator. RedisBloom then treats the undersized allocation as if it contained the full width × depth counter grid.
Subsequent operations index into the buffer using the original, non-truncated dimensions. Reads return adjacent heap contents, exposing sensitive Redis state. Writes corrupt neighboring allocations, which can be shaped to hijack control flow inside the Redis server process. Exploitation requires that the attacker authenticate to Redis, but no other privileges are needed.
Root Cause
The root cause is unchecked integer arithmetic in the size calculation used by NewCMSketch(). RedisBloom does not validate that width * depth * sizeof(counter) fits within the destination integer type before calling the allocator. This falls squarely into [CWE-190] Integer Overflow or Wraparound.
Attack Vector
Exploitation requires network access to a Redis instance and knowledge of the Redis password. The attacker connects as a normal client and issues a crafted CMS.INITBYDIM command with width and depth values selected to force wraparound. Follow-up CMS.* operations on the resulting sketch drive the out-of-bounds read and write primitives.
The vulnerability is described in prose only; no verified public exploit code is available at this time. See the RedisBloom GitHub Security Advisory for the vendor's technical description.
Detection Methods for CVE-2024-55656
Indicators of Compromise
- Unexpected crashes or segmentation faults in the redis-server process shortly after CMS.INITBYDIM commands.
- Redis slowlog or MONITOR entries containing CMS.INITBYDIM invocations with unusually large width or depth arguments.
- Anomalous heap growth or memory usage spikes in Redis instances that load the RedisBloom module.
Detection Strategies
- Inspect Redis command logs for CMS.INITBYDIM, CMS.INCRBY, and related CMS.* commands with argument values that could induce integer wraparound.
- Correlate authenticated Redis client sessions with subsequent RedisBloom errors or process restarts.
- Enable Redis ACL logging and alert on clients issuing module commands they do not normally use.
Monitoring Recommendations
- Instrument Redis with the ACL log and slowlog, and forward events to a central SIEM for retention and analysis.
- Monitor redis-server for abnormal termination, coredumps, and out-of-memory conditions on hosts running RedisBloom.
- Track the installed RedisBloom module version via MODULE LIST across the fleet to identify unpatched instances.
How to Mitigate CVE-2024-55656
Immediate Actions Required
- Upgrade RedisBloom to a fixed release: 2.2.19, 2.4.12, 2.6.14, or 2.8.2, matching the branch currently deployed.
- Rotate Redis authentication credentials, especially where the password may have been shared with untrusted clients.
- Restrict network access to Redis so that only trusted application hosts can reach the service.
Patch Information
The RedisBloom maintainers fixed the integer overflow in versions 2.2.19, 2.4.12, 2.6.14, and 2.8.2. Details and patch references are available in the RedisBloom GitHub Security Advisory GHSA-x5rx-rmq3-ff3h.
Workarounds
- Use Redis ACLs to deny CMS.* commands to clients that do not require Count-Min Sketch functionality.
- Unload the RedisBloom module with MODULE UNLOAD bf on instances that do not use probabilistic data structures until patching is complete.
- Enforce strong, unique Redis passwords and require TLS for all client connections to reduce exposure to unauthenticated network attackers.
# Example: restrict RedisBloom commands via Redis ACLs
redis-cli ACL SETUSER appuser on >StrongPasswordHere ~* +@read +@write -@module
redis-cli ACL SETUSER bloomuser on >AnotherStrongPassword ~bloom:* +cms.query +bf.exists -cms.initbydim
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
