Cloudanix VulnDB

CVE-2024-31227

None

CVSS

—

EPSS

0.4%

Published

Oct 7, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A logged-in administrator can accidentally or deliberately break the database server so that it stops responding until someone restarts it.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

An authenticated user with sufficient privileges can supply a malformed ACL selector that causes an unhandled error path, resulting in an immediate server panic and process termination.

Why it matters to the business

Redis instances become unavailable until manually restarted, interrupting applications that rely on the database for caching, sessions, or real-time data and potentially causing outages during peak usage.

How an attack unfolds

An attacker who has already obtained credentials with ACL modification rights crafts a specially formed selector string, submits it via the ACL SETUSER or similar command, and then triggers evaluation of that selector; the server crashes on access, producing a denial of service. No public exploitation or named threat actors are associated with this issue.

How to fix it

Upgrade redis to version 7.2.6 or 7.4.1 (commit ae6a2aa95cd094b032e7a69b8b59f64dd1ed085f). For the listed Go packages, update to github.com/lestrrat-go/jwx 1.2.27 or github.com/lestrrat-go/jwx/v2 2.0.18. There are no configuration workarounds; apply the version updates immediately.

How to confirm the fix worked

After patching, verify the running Redis version with INFO server, attempt to create and use previously problematic ACL selectors in a test environment, and confirm absence of the panic condition. Re-run any existing ACL test suites.

Typical attack path

  1. Obtain valid credentials with ACL modification privileges
  2. Issue a command that registers a malformed ACL selector
  3. Cause the selector to be evaluated (e.g., via subsequent authentication or command checks)
  4. Observe server panic and termination

How to detect it

Search Redis server logs for abrupt termination messages or stack traces around ACL command processing; correlate with authentication events that precede the crash. Review audit logs for recent ACL SETUSER or ACL LOAD commands from non-standard administrative sources.

What your security team should do

  • Schedule immediate upgrade of all Redis 7.x deployments to the fixed releases
  • Restrict ACL modification privileges to the smallest possible set of administrative accounts
  • Monitor for unexpected Redis process restarts in orchestration and monitoring platforms
  • Include this CVE in the next patch-window review even though EPSS remains low

The record

Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:9 redis 0 7.2.6-1.module_el9.5.0+130+36ae7635
AlmaLinux:9 redis-devel 0 7.2.6-1.module_el9.5.0+130+36ae7635
AlmaLinux:9 redis-doc 0 7.2.6-1.module_el9.5.0+130+36ae7635
Alpine:v3.17 redis 0 7.0.15-r1
Alpine:v3.18 redis 0 7.0.15-r1
Alpine:v3.19 redis 0 7.2.4-r1
Alpine:v3.20 valkey 0 7.2.7-r0
Alpine:v3.21 valkey 0 7.2.7-r0
Alpine:v3.22 valkey 0 7.2.7-r0
Bitnami keydb 7.0.0 No fix
Bitnami keydb 7.0.0 7.2.6
Bitnami redis 7.0.0 7.2.6
Bitnami redis 7.0.0 7.2.8
Bitnami valkey 0 7.2.7
Bitnami valkey 7.0.0 7.2.6
Chainguard py3-redis 0 0
Chainguard py3.10-redis 0 0
Chainguard py3.11-redis 0 0
Chainguard py3.12-redis 0 0
Chainguard py3.13-redis 0 0
Chainguard redis-7.2 0 7.2.6-r0
Chainguard redis-7.2-bitnami-compat 0 7.4.1-r0
Chainguard redis-7.2-iamguarded-compat 0 7.2.12-r2
Chainguard redis-7.4 0 7.4.1-r0
Chainguard redis-7.4-bitnami-compat 0 7.4.1-r0
Chainguard redis-7.4-iamguarded-compat 0 7.4.1-r0
Chainguard redis-benchmark-7.2 0 7.2.12-r2
Chainguard redis-benchmark-7.4 0 7.4.1-r0
Chainguard redis-cli-7.2 0 7.4.1-r0
Chainguard redis-cli-7.4 0 7.4.1-r0
Chainguard redis-cluster-7.2-bitnami-compat 0 7.4.1-r0
Chainguard redis-cluster-7.2-iamguarded-compat 0 7.2.12-r2
Chainguard redis-cluster-7.4-bitnami-compat 0 7.4.1-r0
Chainguard redis-cluster-7.4-iamguarded-compat 0 7.4.1-r0
Chainguard redis-sentinel-7.2-bitnami-compat 0 7.4.1-r0
Chainguard redis-sentinel-7.2-iamguarded-compat 0 7.2.12-r2
Chainguard redis-sentinel-7.4-bitnami-compat 0 7.4.1-r0
Chainguard redis-sentinel-7.4-iamguarded-compat 0 7.4.1-r0
Debian:12 redis 0 No fix
Debian:13 redict 0 7.3.1+ds-1
Debian:13 redis 0 No fix
Debian:13 redis 0 5:7.0.15-2
Debian:13 valkey 0 No fix
Debian:13 valkey 0 8.0.1+dfsg1-1
Debian:14 redict 0 7.3.1+ds-1
Debian:14 redis 0 5:7.0.15-2
Debian:14 valkey 0 8.0.1+dfsg1-1
Mageia:9 redis 0 7.0.14-1.1.mga9
Red Hat:enterprise_linux:9::appstream redis 0 0:7.2.6-1.module+el9.5.0+22422+63e067d8
Red Hat:enterprise_linux:9::appstream redis-debuginfo 0 0:7.2.6-1.module+el9.5.0+22422+63e067d8
Red Hat:enterprise_linux:9::appstream redis-debugsource 0 0:7.2.6-1.module+el9.5.0+22422+63e067d8
Red Hat:enterprise_linux:9::appstream redis-devel 0 0:7.2.6-1.module+el9.5.0+22422+63e067d8
Red Hat:enterprise_linux:9::appstream redis-doc 0 0:7.2.6-1.module+el9.5.0+22422+63e067d8
SUSE:Linux Enterprise Module for Server Applications 15 SP5 redis7 0 7.0.8-150500.3.12.1
SUSE:Linux Enterprise Module for Server Applications 15 SP6 redis 0 7.2.4-150600.3.3.1
SUSE:Linux Enterprise Module for Server Applications 15 SP6 redis7 0 7.0.8-150600.8.3.1
Ubuntu:20.04:LTS redis 0 No fix
Ubuntu:22.04:LTS redis 0 No fix
Ubuntu:24.04:LTS redis 0 No fix
Ubuntu:24.10 redis 0 No fix
Ubuntu:25.04 redis 0 No fix
Ubuntu:25.10 redis 0 No fix
Ubuntu:Pro:14.04:LTS redis 0 No fix
Ubuntu:Pro:16.04:LTS redis 0 No fix
Ubuntu:Pro:18.04:LTS redis 0 No fix
Ubuntu:Pro:20.04:LTS redis 0 No fix
Ubuntu:Pro:22.04:LTS redis 0 No fix
Wolfi redis-7.2 0 7.2.6-r0
Wolfi redis-7.2-bitnami-compat 0 7.4.1-r0
Wolfi redis-7.4 0 7.4.1-r0
Wolfi redis-benchmark-7.2 0 7.2.12-r2
Wolfi redis-cli-7.2 0 7.4.1-r0
Wolfi redis-cluster-7.2-bitnami-compat 0 7.4.1-r0
Wolfi redis-sentinel-7.2-bitnami-compat 0 7.4.1-r0
openSUSE:Leap 15.5 redis7 0 7.0.8-150500.3.12.1
openSUSE:Leap 15.6 redis 0 7.2.4-150600.3.3.1
openSUSE:Leap 15.6 redis7 0 7.0.8-150600.8.3.1
openSUSE:Tumbleweed redis 0 8.0.2-1.1
openSUSE:Tumbleweed valkey 0 8.0.1-1.1

Related vulnerabilities