CVE-2023-41056 Redis vulnerable to integer overflow in certain payloads
Attackers can trigger an integer overflow in Redis memory buffer resizing, leading to heap overflow and potential remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-41056?
CVE-2023-41056 is a high-severity vulnerability in Fedoraproject Fedora, published on 10 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code execution. This issue has been patched in version 7.0.15 and 7.2.4.
Which versions are affected by CVE-2023-41056?
3 open source packages ship an affected version, including keydb, redis and valkey. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
keydb Bitnami | From 7.0.9 | 7.0.15, 7.2.4 |
redis Bitnami | From 7.0.9 | 7.0.15, 7.2.4 |
valkey Bitnami | From 7.0.9 | 7.0.15, 7.2.4 |
Linux distribution packages (6)
redis Red Hat:enterprise_linux:9::appstream | All versions | 0:7.0.12-2.module+el9.3.0+21263+4e58afe8 |
redis-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:7.0.12-2.module+el9.3.0+21263+4e58afe8 |
redis-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:7.0.12-2.module+el9.3.0+21263+4e58afe8 |
redis-devel Red Hat:enterprise_linux:9::appstream | All versions | 0:7.0.12-2.module+el9.3.0+21263+4e58afe8 |
redis-doc Red Hat:enterprise_linux:9::appstream | All versions | 0:7.0.12-2.module+el9.3.0+21263+4e58afe8 |
redis openSUSE:Tumbleweed | All versions | 7.2.4-1.1 |
Products include Fedoraproject Fedora, Redis Redis.
How do I fix CVE-2023-41056?
Upgrade keydb to a fixed version for your release line: 7.0.15 or 7.2.4.
Is CVE-2023-41056 being exploited?
There is no known exploitation of CVE-2023-41056 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2023-41056, BELL-CVE-2023-41056, BIT-keydb-2023-41056, BIT-redis-2023-41056, BIT-valkey-2023-41056, CLEANSTART-2026-DK92825 and 6 more.