CVE-2024-10396

What it actually does

Malformed ACL input to StoreACL and FetchACL RPC handling triggers server process crash, uninitialized memory exposure, and potential corruption of audit log entries or other stored ACLs.

Why it matters to the business

Service outages on affected Redis deployments across 455 downstream dependents, risk of sensitive memory disclosure, and possible log integrity issues; patches available since 2024 but old Ubuntu releases remain exposed.

How an attack unfolds

An authenticated user crafts a malformed ACL and sends it via the StoreACL RPC; the server crashes or leaks memory and may write garbage to the audit log. Malformed ACLs returned in FetchACL responses can similarly crash clients and corrupt server-stored ACLs.

How to fix it

Upgrade redis on Ubuntu 14.04 to 2:2.8.4-2ubuntu0.2, on 16.04 to 2:3.0.6-1, and on 18.04 to 5:4.0.9-1 or later; restrict authenticated access until patches are applied.

How to confirm the fix worked

Confirm package versions match the listed fixed releases; test StoreACL and FetchACL operations with known-good ACLs to verify stability and absence of memory exposure.

Typical attack path

1. Obtain authenticated access to the fileserver
2. Send malformed ACL via StoreACL RPC
3. Trigger crash or memory exposure on server
4. Optionally abuse FetchACL response path to impact clients and stored ACL data

How to detect it

Review server and client process crash logs, audit log entries containing unexpected garbage, and any reports of uninitialized memory in ACL responses around the time of authenticated ACL operations.

What your security team should do

• Apply the exact fixed package versions immediately on all listed Ubuntu releases
• Monitor for crashes correlated with ACL operations
• Reduce authenticated user privileges where possible until upgraded