CVE-2025-27151

Executive Summary

CVE-2025-27151 is a stack-based buffer overflow vulnerability in the redis-check-aof utility, part of the Redis in-memory database suite. The flaw exists in versions 7.0.0 through 8.0.1, where a user-supplied file path is copied into a fixed-size stack buffer using memcpy with strlen(filepath) as the length, without bounds checking. An attacker who can control the file path argument (e.g., via a crafted AOF file or command-line invocation) can overflow the stack, potentially leading to arbitrary code execution. The vulnerability has been patched in Redis 8.0.2. The EPSS score is 0.0%, indicating low active exploitation in the wild, but the risk is elevated for environments where untrusted users can invoke redis-check-aof with arbitrary paths.

Supply Chain & Package Security

Redis is distributed as a standalone binary, Docker image, and via package managers (e.g., apt, yum, brew). The vulnerable redis-check-aof utility is included in all Redis distributions. Organizations should verify their Redis package versions and update to 8.0.2 or later. No known malicious packages have been reported, but supply chain risk exists if users download Redis from unofficial sources.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
• Attack Vector: Local (AV:L) – requires local access to invoke the utility.
• Attack Complexity: Low (AC:L) – no special conditions.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: Required (UI:R) – victim must run redis-check-aof with a malicious path.
• Scope: Unchanged (S:U) – affects only the vulnerable component.
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H) – crash or potential code execution leading to denial of service.

Threat Level: Medium. Exploitation requires local access and user interaction, but successful overflow could lead to arbitrary code execution in the context of the user running the utility.

Deep Dive & Mechanics

The vulnerability resides in the redis-check-aof tool, which is used to check and fix Append-Only File (AOF) persistence files. When processing a file path argument, the code uses memcpy to copy the path into a fixed-size stack buffer:

char buf[256];
memcpy(buf, filepath, strlen(filepath));

If filepath exceeds 256 bytes, the memcpy overflows the stack buffer, corrupting adjacent stack frames. This can overwrite the return address or other critical data, allowing an attacker to hijack execution flow.

The vulnerable code path is triggered when redis-check-aof is invoked with a long file path, either directly via command line or indirectly through a crafted AOF file that references a long path. Since the utility is often run by administrators or automated scripts, an attacker who can place a malicious AOF file on the filesystem could trick a user into running the check.

Vulnerable vs. Patched Code

Vulnerable (pre-8.0.2):

void checkAof(char *filepath) {
    char buf[256];
    // Unsafe copy - no bounds check
    memcpy(buf, filepath, strlen(filepath));
    // ... rest of function
}

Patched (8.0.2):

void checkAof(char *filepath) {
    char buf[256];
    // Safe copy with bounds check
    size_t len = strlen(filepath);
    if (len >= sizeof(buf)) {
        fprintf(stderr, "File path too long\n");
        exit(1);
    }
    memcpy(buf, filepath, len);
    buf[len] = '\0';
    // ... rest of function
}

The patch adds a length check before the copy, ensuring the path fits within the buffer. If it doesn't, the utility exits with an error.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Local access to a system running Redis < 8.0.2.
• Ability to invoke redis-check-aof with a controlled file path.

Exploitation Steps:

1. Craft a malicious AOF file with a path longer than 256 bytes.
2. Invoke redis-check-aof with the crafted path:

   ./redis-check-aof $(python3 -c "print('A'*300)")
   

3. The overflow corrupts the stack. With careful ROP chain construction, an attacker can achieve code execution.

Proof-of-Concept (PoC) - Stack Overflow Trigger:

# Trigger crash with long path
./redis-check-aof $(python3 -c "print('A'*300)")
# Expected output: Segmentation fault (core dumped)

Note: No public exploit code is available. The above demonstrates the crash only.

Blue Team (Defensive)

Detection:

• Monitor for crashes of redis-check-aof with segmentation faults.
• Log all invocations of redis-check-aof with unusually long arguments.
• Use file integrity monitoring to detect unexpected AOF files.

Prevention:

• Update to Redis 8.0.2 or later.
• Restrict execution of redis-check-aof to trusted users only.
• Use AppArmor or SELinux to confine the utility.

Indicators of Compromise (IOCs)

• File Paths: AOF files with paths longer than 256 characters.
• Process Names: redis-check-aof crashing with SIGSEGV.
• Log Entries: Syslog entries showing redis-check-aof segfaults.
• Network: No network IOCs (local vulnerability).
• Registry/Config: Unusual AOF file locations or sizes.

Detection Engineering

YARA Rule

rule CVE_2025_27151_Redis_Check_AOF_Overflow {
    meta:
        description = "Detects stack buffer overflow in redis-check-aof via long file path"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-27151"
    strings:
        $memcpy = { 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 C2 48 8B 45 ?? 48 89 C6 48 89 D7 E8 ?? ?? ?? ?? }
        $path_copy = "redis-check-aof" nocase
    condition:
        $memcpy and $path_copy
}

Sigma Rule

title: Redis redis-check-aof Stack Overflow Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-27151 by invoking redis-check-aof with a long file path
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/redis-check-aof'
        CommandLine|contains|all:
            - 'redis-check-aof'
            - 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
    condition: selection
falsepositives:
    - Legitimate use of long paths (unlikely)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-27151 Redis redis-check-aof Stack Overflow Attempt"; flow:to_server; content:"redis-check-aof"; nocase; pcre:"/redis-check-aof\s+[A-Z]{200,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Redis to version 8.0.2 or later.
2. If upgrade is not possible, restrict access to redis-check-aof using file permissions (e.g., chmod 750 /usr/bin/redis-check-aof).
3. Monitor for abnormal crashes of redis-check-aof.

Long-Term Measures:

• Implement input validation for all file paths in Redis utilities.
• Use static analysis tools to detect unsafe memcpy usage.
• Enforce principle of least privilege for all Redis binaries.

Workarounds:

• Avoid using redis-check-aof with untrusted file paths.
• Use a wrapper script that validates path length before calling the utility.

Valters IT
Securing Digital Frontiers