CVE-2025-27151

What it actually does

Stack-based buffer overflow in redis-check-aof caused by memcpy using strlen on a user-controlled filepath copied into a fixed-size stack buffer, enabling stack corruption and potential code execution.

Why it matters to the business

Attackers with the ability to invoke the affected utility on untrusted input can gain code execution on Redis infrastructure, leading to data theft, service disruption, or lateral movement; high downstream dependency count increases exposure surface across many deployments.

How an attack unfolds

An attacker supplies an excessively long file path argument to redis-check-aof; the utility performs an unbounded copy into a stack buffer, overflows the stack, and can hijack control flow to execute attacker-supplied code without requiring network access or authentication beyond local execution privileges.

How to fix it

Upgrade redis/redis to the fixed commit 994bc96bb1744cb153392fc96bdba43eae56e17f or release 8.0.2; apply the corresponding fixed icu package versions on Ubuntu 14.04 LTS systems; verify all instances of the redis-check-aof binary are replaced.

How to confirm the fix worked

Confirm the redis-check-aof binary reports version 8.0.2 or later; run the utility against a known long path in a test environment and verify absence of crashes or memory corruption indicators; scan package manifests to ensure no pre-8.0.2 binaries remain.

Typical attack path

1. Obtain local or command execution access on a system running an affected Redis version
2. Invoke redis-check-aof with a crafted file path argument exceeding the stack buffer size
3. Trigger the memcpy operation that copies the oversized path
4. Overwrite return addresses or control data on the stack
5. Achieve arbitrary code execution and establish persistence or exfiltrate data

How to detect it

Search process execution logs and command history for redis-check-aof invocations containing unusually long path arguments; inspect core dumps or crash reports referencing buffer overflows in the aof checker binary; review authentication and sudo logs for unexpected use of the utility.

• redis-check-aof
• memcpy.*strlen.*filepath

What your security team should do

• Immediately upgrade all Redis installations to 8.0.2 or the listed fixed commit
• Restrict execution of redis-check-aof to trusted users and audited scripts only
• Monitor package update channels for downstream dependents and rebuild affected containers
• Add redis-check-aof invocation logging to SIEM for anomaly detection