Redis is a high-performance, in-memory key-value store widely used for caching, session management, real-time analytics, and message brokering. It is deployed by enterprises and developers to achieve low-latency data access and high throughput. Redis supports advanced data structures like lists, sets, and sorted sets, making it versatile for various applications.
CVE-2022-0543 is a critical vulnerability specific to Debian and Debian-based distributions of Redis. It arises from a packaging flaw where the Lua sandbox, intended to restrict script execution, is improperly configured. This allows an attacker to break out of the sandbox and execute arbitrary code on the host system.
The vulnerability is triggered through the EVAL or EVALSHA commands, which execute Lua scripts. Due to a missing package dependency, the Lua environment includes functions that can be abused to call system commands. Specifically, the 'lua-open' module is inadvertently exposed, enabling functions like 'os.execute' to run.
Exploitation of CVE-2022-0543 can lead to full remote code execution with the privileges of the Redis process. An attacker can compromise the entire system, steal sensitive data, install malware, or disrupt services. Given the CVSS score of 10.0, this vulnerability poses a severe risk to affected deployments.
- Upgrade Redis to version 5.0.14-2+deb11u1, 6.0.16-1+deb11u1, or 6.2.6-1+deb11u1 for Debian 11, or apply the latest patch for your distribution.
- If immediate upgrade is not possible, apply the official Debian security patch (DSA-5081-1) to mitigate the vulnerability.
- Restrict network access to Redis instances using firewalls or security groups, allowing only trusted IP addresses.
- Disable the EVAL and EVALSHA commands if not required, by renaming them in the Redis configuration file.
- Run Redis with minimal privileges using a dedicated non-root user to limit the impact of a compromise.
- Enable Redis authentication with a strong password to prevent unauthorized access to the Lua scripting interface.
- Monitor Redis logs for unusual script execution patterns or unexpected system commands.
- Use containerization or sandboxing technologies to isolate Redis processes from the host system.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →