CVE-2024-46981

What it actually does

An authenticated user can submit a crafted Lua script via EVAL or EVALSHA that manipulates Redis garbage collection internals, resulting in remote code execution on the server process.

Why it matters to the business

Compromise of Redis servers could expose cached data, allow lateral movement, and interrupt dependent applications; moderate EPSS with stable trend and no known ransomware use reduces immediate urgency but widespread Redis deployment increases overall exposure.

How an attack unfolds

An attacker who possesses valid Redis credentials connects to the instance and issues a malicious Lua script through EVAL/EVALSHA commands; the script is crafted to interfere with garbage collection, ultimately achieving arbitrary code execution. No named threat actors or campaigns are associated with this issue.

How to fix it

Upgrade redis/redis to the fixed commit a0a6f23d997b024689ba157916837f493a593a34, corresponding to versions 7.4.2, 7.2.7, or 6.2.17. As an alternative mitigation without upgrading the binary, apply ACL rules that deny the EVAL and EVALSHA commands to untrusted users.

How to confirm the fix worked

Confirm the running Redis binary reports a version of 7.4.2 or newer (or the equivalent 7.2.7/6.2.17 releases). Verify that ACL policies correctly block EVAL/EVALSHA for non-administrative users if the workaround is applied.

Typical attack path

1. Obtain valid Redis authentication credentials
2. Establish a connection to the target Redis instance
3. Submit a specially crafted Lua script using EVAL or EVALSHA
4. Trigger garbage-collection manipulation to obtain remote code execution

How to detect it

Review Redis command logs and slow-log entries for frequent or anomalous EVAL/EVALSHA usage; correlate with subsequent unexpected process creation or memory behavior on the Redis host.

What your security team should do

• Apply the listed fixed versions or commit immediately on all Redis deployments
• Temporarily restrict EVAL and EVALSHA via ACL until patching is complete
• Audit existing Redis access controls and remove unnecessary Lua-script privileges
• Include Redis version checks in routine vulnerability scanning