CVE-2021-32625: 
Redis vulnerability analysis and mitigation

Redis, an open source (BSD licensed) in-memory data structure store, was found to contain an integer overflow vulnerability (CVE-2021-32625) in version 6.0 and newer. The vulnerability was discovered as a result of an incomplete fix for a previous issue (CVE-2021-29477) and was disclosed on June 1, 2021. The vulnerability affects Redis installations running version 6.0 through versions prior to 6.0.14 and 6.2.4 (Redis Advisory).

The vulnerability is an integer overflow bug that can be exploited using the STRALGO LCS command to corrupt the heap. The issue has been assigned a CVSS v3.1 base score of 8.8 HIGH (NIST: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and 7.5 HIGH by GitHub (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability is classified under CWE-190 (Integer Overflow) by NIST and CWE-680 (Integer Overflow to Buffer Overflow) by GitHub (NVD).

If successfully exploited, this vulnerability could allow authenticated attackers to corrupt the heap and potentially achieve remote code execution on affected Redis servers (Redis Advisory).

The vulnerability requires authentication and can be exploited by sending specially crafted STRALGO LCS commands to the Redis server. The attack complexity is rated as Low by NIST and High by GitHub, indicating some level of technical sophistication may be required for successful exploitation (NVD).

The vulnerability has been fixed in Redis versions 6.0.14 and 6.2.4. For systems that cannot immediately update, there are two workarounds available: 1) Use ACL configuration to prevent clients from using the STRALGO LCS command, or 2) On 64-bit systems with the fixes of CVE-2021-29477 (6.2.3 or 6.0.13), ensure that the proto-max-bulk-len config parameter is smaller than 2GB (default is 512MB) (Redis Advisory).