CVE-2024-46981

Executive Summary

CVE-2024-46981 is a critical vulnerability in Redis, an open-source in-memory database. An authenticated attacker can exploit a specially crafted Lua script to manipulate the garbage collector, potentially leading to remote code execution (RCE). The vulnerability affects Redis versions prior to 6.2.17, 7.2.7, and 7.4.2. While the EPSS score is currently 0.0%, indicating low exploitation likelihood, the high CVSS score of 7.0 and the potential for RCE make this a significant threat. The primary attack vector requires authenticated access, but once exploited, an attacker can achieve full system compromise.

Supply Chain & Package Security

Redis is widely distributed as a package in various Linux distributions and container images. Organizations using Redis in their infrastructure should immediately verify their version and apply patches. The vulnerability is not specific to any package manager but affects the core Redis server binary.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.0 (High)
• Attack Vector: Network (AV:N) - Exploitable over the network.
• Attack Complexity: Low (AC:L) - No special conditions required.
• Privileges Required: Low (PR:L) - Attacker needs valid credentials.
• User Interaction: None (UI:N) - No user action required.
• Scope: Unchanged (S:U) - Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) - Full data access possible.
• Integrity Impact: High (I:H) - Data can be modified.
• Availability Impact: High (A:H) - Service can be disrupted.

Deep Dive & Mechanics

The vulnerability resides in Redis's Lua scripting engine. Redis allows authenticated users to execute Lua scripts via the EVAL and EVALSHA commands. The garbage collector in the Lua environment can be manipulated by a crafted script to cause memory corruption. This corruption can be leveraged to achieve arbitrary code execution within the Redis process.

The attack works by:

1. An authenticated user sends a specially crafted Lua script to the Redis server.
2. The script exploits weaknesses in the Lua garbage collector, causing it to free memory that is still in use (use-after-free) or corrupt memory structures.
3. This memory corruption can be used to overwrite function pointers or other critical data, leading to arbitrary code execution.
4. The attacker can then execute arbitrary commands on the server with the privileges of the Redis process.

The vulnerability is particularly dangerous because Redis is often deployed with minimal security controls, and authenticated access may be easily obtained through weak passwords or default configurations.

Vulnerable vs. Patched Code

The exact code changes are not publicly available, but the fix involves hardening the Lua garbage collector against manipulation. The patched versions (6.2.17, 7.2.7, 7.4.2) include modifications to prevent the exploitation of garbage collector weaknesses.

Vulnerable Code (Conceptual):

// In vulnerable versions, the Lua garbage collector could be tricked into
// freeing objects that are still referenced, leading to use-after-free.
// Example: A crafted script could cause a table to be collected while
// still being iterated.

Patched Code (Conceptual):

// In patched versions, additional checks are added to prevent premature
// garbage collection of objects in use. The garbage collector is made
// more robust against manipulation.
// Example: Reference counting is enforced during script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Redis server (version < 6.2.17, < 7.2.7, or < 7.4.2)
• Valid credentials for Redis authentication

Exploitation Steps:

1. Connect to the Redis server using redis-cli.
2. Authenticate using AUTH <password>.
3. Send a crafted Lua script that exploits the garbage collector. The script would be designed to cause memory corruption and achieve code execution.

Example Lua Script (Conceptual):

-- This is a conceptual example. Actual exploit code is not publicly available.
local function trigger_gc()
    -- Manipulate garbage collector to cause use-after-free
    local t = {}
    setmetatable(t, {__gc = function() end})
    collectgarbage()
    -- Use the freed memory to overwrite function pointers
end
trigger_gc()

Note: As of now, no public exploit code is available. The above is a conceptual representation.

Blue Team (Defensive)

Detection and Prevention:

1. Patch Immediately: Upgrade Redis to version 6.2.17, 7.2.7, or 7.4.2.
2. Restrict Lua Script Execution: Use ACLs to block EVAL and EVALSHA commands for untrusted users.
3. Monitor Redis Logs: Look for unusual Lua script execution patterns or errors related to garbage collection.
4. Network Segmentation: Isolate Redis servers from untrusted networks.
5. Strong Authentication: Enforce strong passwords and rotate them regularly.

Indicators of Compromise (IOCs)

• Network Indicators:
  • Unusual Lua script payloads in Redis traffic (e.g., scripts containing garbage collector manipulation functions).
  • Connections from unknown IPs to Redis port 6379.
• Host Indicators:
  • Redis process crashes or segmentation faults.
  • Unexpected child processes spawned by Redis.
  • Unusual files written to disk by the Redis user.
• Log Indicators:
  • Redis logs showing repeated EVAL or EVALSHA commands with large or complex scripts.
  • Errors related to Lua memory management.

Detection Engineering

YARA Rule

rule CVE_2024_46981_Redis_Lua_Exploit {
    meta:
        description = "Detects Lua scripts attempting to exploit CVE-2024-46981 in Redis"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-46981"
    strings:
        $gc_manipulation = /collectgarbage|__gc|setmetatable/
        $lua_function = /EVAL|EVALSHA/
    condition:
        $lua_function and #gc_manipulation > 2
}

Sigma Rule

title: Redis Lua Script Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-46981 via Lua script manipulation
author: Valters IT
date: 2024-10-27
logsource:
    category: application
    product: redis
detection:
    selection:
        EventID: 1000  # Redis command execution event
        Command: "EVAL" or "EVALSHA"
        ScriptContent|contains: 
            - "collectgarbage"
            - "__gc"
            - "setmetatable"
    condition: selection
falsepositives:
    - Legitimate use of Lua garbage collection in scripts
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 6379 (msg:"CVE-2024-46981 Redis Lua Exploit Attempt"; flow:to_server,established; content:"EVAL"; nocase; content:"collectgarbage"; within:100; reference:cve,2024-46981; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patching: Upgrade Redis to version 6.2.17, 7.2.7, or 7.4.2.
2. Workaround: If patching is not possible, restrict Lua script execution using ACLs:

   ACL SETUSER default -EVAL -EVALSHA
   

3. Network Controls: Place Redis behind a firewall and restrict access to trusted IPs.
4. Monitoring: Implement detection rules (YARA, Sigma, Suricata) to identify exploitation attempts.
5. Least Privilege: Run Redis with minimal system privileges and use a dedicated user account.

Valters IT
DevSecOps & Cyber Threat Intelligence
Securing your infrastructure, one CVE at a time.