CVE-2025-27151

説明

A flaw was found in Redis. Using memcpy with the strlen filepath when copying a user-supplied file path into a fixed-size stack buffer in redis-check-aof results in a stack-based buffer overflow. This flaw allows a local attacker to trigger the overflow by providing a specially crafted file path, allowing potential code execution. The primary consequence is a possible denial of service.

詳細

The availability impact is limited to the instance of Redis and not to the system as a whole.

CVSS (Common Vulnerability Scoring System) のスコアの詳細

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v3 スコアの内訳

Red HatNVDcve.org
ベーススコア2.59.8N/A
攻撃ベクトルLocalNetworkN/A
攻撃の複雑さHighLowN/A
必要な権限LowNoneN/A
ユーザー関与レベルNoneNoneN/A
範囲UnchangedUnchangedN/A
機密性NoneHighN/A
完全性への影響NoneHighN/A
可用性への影響LowHighN/A

ベクトル

Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

脆弱性の原因 (CWE) の理解

CWE-805

Integrity,Confidentiality,Availability

Technical Impact: Read Memory; Modify Memory; Execute Unauthorized Code or Commands

Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy. This can often be used to subvert any other security service.

Availability

Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU)

Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.

よくある質問

Not sure what something means? Check out our Security Glossary.

エラータ通知の受信を希望しますか? こちらで登録してください。