RedisBloom Integer Overflow RCE Vulnerability (CVE-2024-55656)
Trend Micro's Zero Day Initiative identified an integer overflow vulnerability in RedisBloom's CMS.INITBYDIM command that allows authenticated attackers to cause memory allocation wraparound, enabling information disclosure and code execution. The vendor released patched versions to address the vulnerability.
What happened
An integer overflow vulnerability was identified in RedisBloom's CMS.INITBYDIM command, which initializes a Count-Min Sketch data structure. The command accepts width and depth parameters that are multiplied together to allocate memory without validation, allowing the multiplication to wrap around.
An attacker with Redis client access and knowledge of the password could exploit this by providing large values for width and depth that cause integer overflow during memory allocation. This results in allocation of less memory than required, enabling out-of-bounds reads and writes.
Reported impact
The vulnerability allows information disclosure through out-of-bounds reads and code execution through out-of-bounds writes to heap memory.
Index analysis
The vulnerability exists in the NewCMSketch function in src/cms.c and the RM_Calloc function in src/module.c, both of which lack sufficient validation of width and depth values before multiplication.
Governance controls
Patched versions were released: 2.8.5, 2.6.16, and 2.4.13.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.