CVE-2023-36824 Heap overflow in COMMAND GETKEYS and ACL evaluation in Redis
Authenticated users can trigger a heap overflow in Redis via crafted commands, potentially leading to remote code execution or memory disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-36824?
CVE-2023-36824 is a high-severity memory corruption vulnerability in Fedoraproject Fedora, published on 11 Jul 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Several scenarios that may lead to authenticated users executing a specially crafted `COMMAND GETKEYS` or `COMMAND GETKEYSANDFLAGS`and authenticated users who were set with ACL rules that match key names, executing a specially crafted command that refers to a variadic list of key names. The vulnerability is patched in Redis 7.0.12.
Which versions are affected by CVE-2023-36824?
3 open source packages ship an affected version, including keydb, redis and valkey. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
keydb Bitnami | From 7.0.0 | 7.0.12 |
redis Bitnami | From 7.0.0 | 7.0.12 |
valkey Bitnami | From 7.0.0 | 7.0.12 |
Products include Fedoraproject Fedora, Redis Redis.
How do I fix CVE-2023-36824?
Upgrade keydb to 7.0.12 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-36824 being exploited?
There is no known exploitation of CVE-2023-36824 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2023-36824, BELL-CVE-2023-36824, BIT-keydb-2023-36824, BIT-redis-2023-36824, BIT-valkey-2023-36824, CLEANSTART-2026-FC95415 and 2 more.