CVE-2024-25116

Vulnerability

Overview

RedisBloom versions 2.0.0 through 2.4.6 and 2.6.0 through 2.6.9 contain a denial-of-service vulnerability in the CF.RESERVE command. The root cause is insufficient input validation for parameters such as MAXITERATIONS and BUCKETSIZE. Without appropriate bounds checking, an attacker can supply values that trigger an assertion failure in the cfCreate function, causing the Redis server process to terminate [1].

Exploitation

Conditions

An attacker must have authenticated access to the Redis server. By issuing a CF.RESERVE command with a large MAXITERATIONS value (e.g., exceeding 65535) or an invalid BUCKETSIZE, the vulnerability can be triggered. The attack does not require any special privileges beyond authentication and can be carried out remotely [1][2].

Impact

Successful exploitation leads to an immediate crash of the Redis server, resulting in a denial of service. All data in memory is lost unless persistence is configured, and the server must be restarted to restore service. The availability impact is high, while confidentiality and integrity are not affected [2].

Mitigation

The vulnerability is fixed in RedisBloom versions 2.4.7 and 2.6.10. Users should upgrade to these patched versions or apply the workaround by restricting access to the CF.RESERVE command for untrusted users. The fix introduces proper bounds checking for MAXITERATIONS and BUCKETSIZE parameters [1][2].