CVE-2024-25115 RedisBloom heap buffer overflow in CF.LOADCHUNK command
Authenticated users can trigger a heap buffer overflow via CF.LOADCHUNK commands, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-25115?
CVE-2024-25115 is a high-severity memory corruption vulnerability in RedisBloom, published on 9 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, specially crafted `CF.LOADCHUNK` commands may be used by authenticated users to perform heap overflow, which may lead to remote code execution. The problem is fixed in RedisBloom 2.4.7 and 2.6.10.
Which versions are affected by CVE-2024-25115?
How do I fix CVE-2024-25115?
No fix has been published for CVE-2024-25115 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-25115 being exploited?
There is no known exploitation of CVE-2024-25115 in the wild and no public exploit code.
Sources
Also known as GHSA-w583-p2wh-4vj5.