• antirez's avatar
    Fix buffer overflows occurring reading redis.conf. · 5727d7ec
    antirez authored
    There was not enough sanity checking in the code loading the slots of
    Redis Cluster from the nodes.conf file, this resulted into the
    attacker's ability to write data at random addresses in the process
    memory, by manipulating the index of the array. The bug seems
    exploitable using the following techique: the config file may be altered so
    that one of the nodes gets, as node ID (which is the first field inside the
    structure) some data that is actually executable: then by writing this
    address in selected places, this node ID part can be executed after a
    jump. So it is mostly just a matter of effort in order to exploit the
    bug. In practice however the issue is not very critical because the
    bug requires an unprivileged user to be able to modify the Redis cluster
    nodes configuration, and at the same time this should result in some
    gain. However Redis normally is unprivileged as well. Yet much better to
    have this fixed indeed.
    
    Fix #4278.
    5727d7ec
cluster.c 203 KB