CVE-2024-51741

What it actually does

An authenticated user with sufficient privileges can create a malformed ACL selector that triggers a server panic and denial of service when the selector is subsequently accessed.

Why it matters to the business

Successful exploitation leads to unplanned downtime and loss of availability for database services, requiring restarts and potentially affecting dependent applications until the instance is recovered.

How an attack unfolds

An attacker with valid credentials and ACL management rights crafts a malformed selector entry. When the server later evaluates or accesses that selector during normal operations, it panics and terminates, causing immediate denial of service.

How to fix it

Upgrade affected Redis installations to version 7.2.7 or 7.4.2. For the listed Ubuntu packages apply the corresponding fixed kernel versions such as 3.13.0-87.133 for linux on 14.04 LTS, 4.4.0-22.39 for linux on 16.04 LTS, and the specific variants listed for aws, gke, hwe, raspi2, snapdragon, lts-utopic, lts-vivid, and lts-wily packages.

How to confirm the fix worked

Confirm the installed Redis version is at least 7.2.7 or 7.4.2 and verify that the relevant Ubuntu package versions match the fixed kernel releases provided for each distribution variant.

Typical attack path

1. Obtain authenticated access with privileges sufficient to manage ACLs
2. Create and store a malformed ACL selector
3. Trigger evaluation or access of the malformed selector through normal server operations
4. Observe server panic and resulting denial of service

How to detect it

Monitor system and application logs for unexpected Redis process crashes or restarts, and review authentication and ACL modification events for unusual selector entries created by privileged accounts.

What your security team should do

• Prioritize patching all Redis instances to the fixed versions immediately given the public availability of the advisory
• Review and restrict ACL management privileges to the minimum necessary accounts
• Implement monitoring for unexpected Redis process terminations and restarts
• Test the upgrade in a non-production environment before broad deployment