Redis 2.8.18-6.2.15 - Authenticated Stack-based Buffer Overflow via Lua Bit Library
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-31449. PoCs published by qwqqaqqwq00, daeseong1209.
AI-analyzed exploit summary This repository contains generic Redis module documentation generation scripts and Lua/C source files from the Redis codebase, but no actual exploit code or technical analysis related to CVE-2024-31449. The files appear to be placeholders or copied code without any vulnerability-specific content.
Description
Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Exploits (2)
This repository contains generic Redis module documentation generation scripts and Lua/C source files from the Redis codebase, but no actual exploit code or technical analysis related to CVE-2024-31449. The files appear to be placeholders or copied code without any vulnerability-specific content.
This repository contains a functional PoC for CVE-2024-31449, a stack buffer overflow in Redis' Lua engine via the `bit.tohex` function. The exploit triggers a crash (DoS) by passing `INT32_MIN` as an argument, causing improper handling of negative values.
References (2)
Scores
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H