CVE Vulnerabilities

CVE-2021-32672

Out-of-bounds Read

Published: Oct 04, 2021 | Modified: Nov 07, 2023
CVSS 3.x
4.3
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.x
4 MEDIUM
AV:N/AC:L/Au:S/C:P/I:N/A:N
RedHat/V2
RedHat/V3
3.1 LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Ubuntu
MEDIUM

Redis is an open source, in-memory database that persists on disk. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer. This issue affects all versions of Redis with Lua debugging support (3.2 or newer). The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14.

Weakness

The product reads data past the end, or before the beginning, of the intended buffer.

Affected Software

Name Vendor Start Version End Version
Redis Redis 3.2.0 (including) 5.0.14 (excluding)
Redis Redis 6.0.0 (including) 6.0.16 (excluding)
Redis Redis 6.2.0 (including) 6.2.6 (excluding)
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat acm-must-gather-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat acmesolver-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat acm-must-gather-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat acm-operator-bundle-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat application-ui-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat cainjector-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat cert-manager-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat cert-manager-webhook-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat cert-policy-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat clusterlifecycle-state-metrics-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat configmap-watcher-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat config-policy-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat console-api-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat console-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat console-header-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat endpoint-component-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat endpoint-monitoring-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat endpoint-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat governance-policy-propagator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat governance-policy-spec-sync-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat governance-policy-status-sync-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat governance-policy-template-sync-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat grafana-dashboard-loader-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat grc-ui-api-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat grc-ui-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat iam-policy-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat klusterlet-addon-lease-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat klusterlet-operator-bundle-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat kui-web-terminal-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat management-ingress-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat mcm-topology-api-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat mcm-topology-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat memcached-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat memcached-exporter-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat metrics-collector-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicloud-manager-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multiclusterhub-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multiclusterhub-repo-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-observability-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-application-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-channel-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-deployable-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-placementrule-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-subscription-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-subscription-release-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat observatorium-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat observatorium-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat openshift-hive-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat rbac-query-proxy-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat rcm-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat redisgraph-tls-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat registration-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat registration-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-aggregator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-api-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-collector-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-ui-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat submariner-addon-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat thanos-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat thanos-receive-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat work-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat acm-grafana-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat acm-must-gather-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat acm-operator-bundle-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat application-ui-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat assisted-image-service-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat cert-policy-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat cluster-backup-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat clusterclaims-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat cluster-curator-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat clusterlifecycle-state-metrics-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat cluster-proxy-addon-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat config-policy-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat console-api-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat console-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat discovery-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat endpoint-monitoring-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat governance-policy-propagator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat governance-policy-spec-sync-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat governance-policy-status-sync-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat governance-policy-template-sync-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat grafana-dashboard-loader-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat grc-ui-api-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat grc-ui-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat iam-policy-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat insights-client-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat insights-metrics-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat klusterlet-addon-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat klusterlet-addon-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat klusterlet-operator-bundle-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat kube-rbac-proxy-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat kube-state-metrics-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat managedcluster-import-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat management-ingress-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat memcached-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat memcached-exporter-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat metrics-collector-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicloud-integrations-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicloud-manager-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multiclusterhub-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multiclusterhub-repo-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-observability-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-application-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-channel-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-deployable-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-placementrule-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-subscription-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-subscription-release-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat node-exporter-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat observatorium-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat observatorium-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat openshift-hive-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat placement-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat prometheus-alertmanager-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat prometheus-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat provider-credential-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat rbac-query-proxy-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat redisgraph-tls-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat registration-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat registration-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat rhacm-agent-service-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat rhacm-assisted-installer-agent-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat rhacm-assisted-installer-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat rhacm-assisted-installer-reporter-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-aggregator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-api-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-collector-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-ui-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat submariner-addon-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat thanos-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat thanos-receive-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat volsync-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat volsync-mover-rclone-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat volsync-mover-restic-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat volsync-mover-rsync-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat work-container *
Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 RedHat rhacm2/redisgraph-tls-rhel8:v2.3.3-3 *
Redis Ubuntu bionic *
Redis Ubuntu esm-apps/bionic *
Redis Ubuntu esm-apps/focal *
Redis Ubuntu focal *
Redis Ubuntu hirsute *
Redis Ubuntu impish *
Redis Ubuntu trusty *
Redis Ubuntu upstream *
Redis Ubuntu xenial *

Potential Mitigations

  • Assume all input is malicious. Use an “accept known good” input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, “boat” may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as “red” or “blue.”
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code’s environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.

References