• Oran Agra's avatar
    Fix integer overflow in intset (CVE-2021-29478) · 789f1015
    Oran Agra authored
    An integer overflow bug in Redis 6.2 could be exploited to corrupt the heap and
    potentially result with remote code execution.
    
    The vulnerability involves changing the default set-max-intset-entries
    configuration value, creating a large set key that consists of integer values
    and using the COPY command to duplicate it.
    
    The integer overflow bug exists in all versions of Redis starting with 2.6,
    where it could result with a corrupted RDB or DUMP payload, but not exploited
    through COPY (which did not exist before 6.2).
    
    (cherry picked from commit 29900d4e)
    789f1015
intset.c 15.9 KB