On July 23, Redis released seven security updates following the disclosure of proof-of-concept (PoC) exploits targeting critical vulnerabilities in versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0. These vulnerabilities, identified by Kimi K3 agents, could allow authenticated users to execute arbitrary code on affected systems.
The exploits leverage the RESTORE command, with some also requiring EVAL and XGROUP commands, or the RedisBloom module. The underlying memory flaws in these versions may lead to remote code execution.
To address these issues, Redis has released the following updates:
- Redis 6.2.23, 7.2.15, and 7.4.10: Fix the Streams shared-NACK use-after-free vulnerability.
- Redis 8.2.8, 8.4.5, and 8.6.5: Address both the Streams issue and the RedisBloom and TDigest out-of-bounds write vulnerabilities.
- Redis 8.8.1: Fixes the RedisBloom and TDigest loaders; the Streams guard was already present in Redis 8.8.0.
Notably, Redis 6.2.22 and 7.4.9, which were the May security updates, did not include the shared-NACK ownership guard, leaving them vulnerable.
Users are strongly advised to upgrade to the fixed releases corresponding to their deployed branches. In the interim, it’s recommended to revoke RESTORE privileges from accounts that do not strictly require it and to block untrusted network access. Restricting RESTORE access mitigates both disclosed attack vectors.
As of July 24, there have been no reports of these vulnerabilities being exploited in the wild.
Technical Details of the Vulnerabilities
The Redis Streams vulnerability involves a shared-ownership bug. A corrupt RDB object can cause two consumers to reference the same pending-entry record. Removing both consumers can lead to a double-free scenario, resulting in memory corruption that can be exploited to execute arbitrary code.
The RedisBloom vulnerability pertains to an out-of-bounds write in the TDigest RDB loader. The loader allocates memory based on a serialized compression value but trusts a separate, attacker-controlled capacity field when determining how much data to load. This mismatch can be exploited to achieve arbitrary code execution.
These findings underscore the critical importance of promptly applying security updates and maintaining strict access controls to mitigate potential threats.
The discovery of these vulnerabilities by Kimi K3 agents highlights the evolving landscape of cybersecurity threats. As attackers develop more sophisticated methods, it becomes imperative for organizations to adopt proactive security measures, including regular software updates and stringent access controls, to safeguard their systems against emerging exploits.
