Bug 1184889 - (CVE-2021-3470) VUL-0: CVE-2021-3470: redis: potential heap overflow when using a heap allocator other than jemalloc or glibc's malloc
(CVE-2021-3470)
VUL-0: CVE-2021-3470: redis: potential heap overflow when using a heap alloc...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P5 - None : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/280601/
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2021-04-16 13:58 UTC by Alexandros Toptsoglou
Modified: 2021-04-16 13:59 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandros Toptsoglou 2021-04-16 13:58:10 UTC
CVE-2021-3470

When using a system with no malloc_usable_size(), zmalloc_size() assumed that the heap allocator always returns blocks that are long-padded. This may not always be the case, and will result with zmalloc_size() returning a size that is bigger than allocated. At least in one case this leads to out of bound write, process crash and a potential security vulnerability. Effectively this does not affect the vast majority of users, who use jemalloc or glibc.

Upstream pull request:
https://github.com/redis/redis/pull/7963

Upstream commit:
https://github.com/redis/redis/commit/9824fe3e392caa04dc1b4071886e9ac402dd6d95

Release notes:
https://raw.githubusercontent.com/redis/redis/5.0.10/00-RELEASENOTES
https://raw.githubusercontent.com/redis/redis/6.0.9/00-RELEASENOTES

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1943623
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3470
https://access.redhat.com/security/cve/CVE-2021-3470
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3470
Comment 1 Alexandros Toptsoglou 2021-04-16 13:59:03 UTC
We ship the version 6.0.10 which is not affected.