Redis 2.8.18-6.2.15 - Authenticated Stack-based Buffer Overflow via Lua Bit Library
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-31449. PoCs published by daeseong1209.
AI-analyzed exploit summary This repository contains a functional PoC for CVE-2024-31449, a stack buffer overflow in Redis' Lua engine via the `bit.tohex` function. The exploit triggers a crash (DoS) by passing `INT32_MIN` as an argument, causing improper handling of negative values.
Description
Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Exploits (1)
This repository contains a functional PoC for CVE-2024-31449, a stack buffer overflow in Redis' Lua engine via the `bit.tohex` function. The exploit triggers a crash (DoS) by passing `INT32_MIN` as an argument, causing improper handling of negative values.
References (2)
Scores
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H