CVE-2022-35977: Integer overflow in certain command arguments can drive Redis to OOM panic
Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted SETRANGE and SORT(RO) commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Other sources
Redis is vulnerable to a denial of service, caused by an integer overflow flaw. By sending specially-crafted SETRANGE and SORT(RO) commands, a local authenticated attacker could exploit this vulnerability to allocate impossible amounts of memory and abort with an OOM panic.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-35977?
CVE-2022-35977 is a vulnerability in Redis, an in-memory database that persists on disk, which allows authenticated users to trigger an integer overflow by issuing specially crafted SETRANGE and SORT(_RO) commands, leading to an out-of-memory panic.
How severe is CVE-2022-35977?
CVE-2022-35977 has a severity rating of medium with a CVSS score of 5.5.
Which software versions are affected by CVE-2022-35977?
Redis versions 6.0.0 to 6.0.17, 6.2.0 to 6.2.9, and 7.0.0 to 7.0.8 are affected by CVE-2022-35977.
How can authenticated users exploit CVE-2022-35977?
Authenticated users can exploit CVE-2022-35977 by issuing specially crafted SETRANGE and SORT(_RO) commands to trigger an integer overflow.
How can I fix CVE-2022-35977?
To fix CVE-2022-35977, upgrade to Redis versions 6.0.18, 6.2.10, or 7.0.9 or later.