Vulnerability: Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed, due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support, starting from 2.6. The problem is fixed in versions 6.2.6, 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
Vulnerability ID: CVE-2021-32626
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/redis/redis
Published: 2021-10-04
File: src/scripting.c
Commit message: Fix invalid memory write on lua stack overflow {CVE-2021-32626}

When LUA call our C code, by default, the LUA stack has room for 20
elements. In most cases, this is more than enough but sometimes it's not
and the caller must verify the LUA stack size before he pushes elements.

On 3 places in the code, there was no verification of the LUA stack size.
On specific inputs this missing verification could have lead to invalid
memory write:
1. On 'luaReplyToRedisReply', one might return a nested reply that will
   explode the LUA stack.
2. On 'redisProtocolToLuaType', the Redis reply might be deep enough
   to explode the LUA stack (notice that currently there is no such
   command in Redis that returns such a nested reply, but modules might
   do it)
3. On 'ldbRedis', one might give a command with enough arguments to
   explode the LUA stack (all the arguments will be pushed to the LUA
   stack)

This commit is solving all those 3 issues by calling 'lua_checkstack' and
verify that there is enough room in the LUA stack to push elements. In
case 'lua_checkstack' returns an error (there is not enough room in the
LUA stack and it's not possible to increase the stack), we will do the
following:
1. On 'luaReplyToRedisReply', we will return an error to the user.
2. On 'redisProtocolToLuaType' we will exit with panic (we assume this
   scenario is rare because it can only happen with a module).
3. On 'ldbRedis', we return an error.
Commit author: meir@redislabs.com

Vulnerable version (before fix):
 void sha1hex(char *digest, char *script, size_t len) {  */  char *redisProtocolToLuaType(lua_State *lua, char* reply) {     char *p = reply;      switch(*p) { char *redisProtocolToLuaType_Aggregate(lua_State *lua, char *reply, int atype) {             if (atype == '%') {                 p = redisProtocolToLuaType(lua,p);             } else {                 lua_pushboolean(lua,1);             }             lua_settable(lua,-3); void luaSortArray(lua_State *lua) { /* Reply to client 'c' converting the top element in the Lua stack to a  * Redis reply. As a side effect the element is consumed from the stack.  */ void luaReplyToRedisReply(client *c, lua_State *lua) {     int t = lua_type(lua,-1);      switch(t) { void luaReplyToRedisReply(client *c, lua_State *lua) {          * field. */          /* Handle error reply. */         lua_pushstring(lua,"err");         lua_gettable(lua,-2);         t = lua_type(lua,-1); void luaReplyToRedisReply(client *c, lua_State *lua) {         if (t == LUA_TTABLE) {             int maplen = 0;             void *replylen = addReplyDeferredLen(c);             lua_pushnil(lua); /* Use nil to start iteration. */             while (lua_next(lua,-2)) {                 /* Stack now: table, key, value */ void luaReplyToRedisReply(client *c, lua_State *lua) {         if (t == LUA_TTABLE) {             int setlen = 0;             void *replylen = addReplyDeferredLen(c);             lua_pushnil(lua); /* Use nil to start iteration. */             while (lua_next(lua,-2)) {                 /* Stack now: table, key, true */ void luaReplyToRedisReply(client *c, lua_State *lua) {         void *replylen = addReplyDeferredLen(c);         int j = 1, mbulklen = 0;         while(1) {             lua_pushnumber(lua,j++);             lua_gettable(lua,-2);             t = lua_type(lua,-1); void ldbEval(lua_State *lua, sds *argv, int argc) { void ldbRedis(lua_State *lua, sds *argv, int argc) {     int j, saved_rc = server.lua_replicate_commands;      lua_getglobal(lua,"redis");     lua_pushstring(lua,"call");     lua_gettable(lua,-2);       /* Stack: redis, redis.call */

Fixed version (after fix):
 void sha1hex(char *digest, char *script, size_t len) {  */  char *redisProtocolToLuaType(lua_State *lua, char* reply) {      if (!lua_checkstack(lua, 5)) {         /*          * Increase the Lua stack if needed, to make sure there is enough room          * to push 5 elements to the stack. On failure, exit with panic.          * Notice that we need, in the worst case, 5 elements because redisProtocolToLuaType_Aggregate          * might push 5 elements to the Lua stack.*/         serverPanic("lua stack limit reach when parsing redis.call reply");     }      char *p = reply;      switch(*p) { char *redisProtocolToLuaType_Aggregate(lua_State *lua, char *reply, int atype) {             if (atype == '%') {                 p = redisProtocolToLuaType(lua,p);             } else {                 if (!lua_checkstack(lua, 1)) {                     /* Notice that here we need to check the stack again because the recursive                      * call to redisProtocolToLuaType might have use the room allocated in the stack */                     serverPanic("lua stack limit reach when parsing redis.call reply");                 }                 lua_pushboolean(lua,1);             }             lua_settable(lua,-3); void luaSortArray(lua_State *lua) { /* Reply to client 'c' converting the top element in the Lua stack to a  * Redis reply. As a side effect the element is consumed from the stack.  */ void luaReplyToRedisReply(client *c, lua_State *lua) {      if (!lua_checkstack(lua, 4)) {         /* Increase the Lua stack if needed to make sure there is enough room          * to push 4 elements to the stack. On failure, return error.          * Notice that we need, in the worst case, 4 elements because returning a map might          * require push 4 elements to the Lua stack.*/         addReplyErrorFormat(c, "reached lua stack limit");         lua_pop(lua,1); // pop the element from the stack         return;     }      int t = lua_type(lua,-1);      switch(t) { void luaReplyToRedisReply(client *c, lua_State *lua) {          * field. */          /* Handle error reply. */         // we took care of the stack size on function start         lua_pushstring(lua,"err");         lua_gettable(lua,-2);         t = lua_type(lua,-1); void luaReplyToRedisReply(client *c, lua_State *lua) {         if (t == LUA_TTABLE) {             int maplen = 0;             void *replylen = addReplyDeferredLen(c);             /* we took care of the stack size on function start */             lua_pushnil(lua); /* Use nil to start iteration. */             while (lua_next(lua,-2)) {                 /* Stack now: table, key, value */ void luaReplyToRedisReply(client *c, lua_State *lua) {         if (t == LUA_TTABLE) {             int setlen = 0;             void *replylen = addReplyDeferredLen(c);             /* we took care of the stack size on function start */             lua_pushnil(lua); /* Use nil to start iteration. */             while (lua_next(lua,-2)) {                 /* Stack now: table, key, true */ void luaReplyToRedisReply(client *c, lua_State *lua) {         void *replylen = addReplyDeferredLen(c);         int j = 1, mbulklen = 0;         while(1) {             /* we took care of the stack size on function start */             lua_pushnumber(lua,j++);             lua_gettable(lua,-2);             t = lua_type(lua,-1); void ldbEval(lua_State *lua, sds *argv, int argc) { void ldbRedis(lua_State *lua, sds *argv, int argc) {     int j, saved_rc = server.lua_replicate_commands;      if (!lua_checkstack(lua, argc + 1)) {         /* Increase the Lua stack if needed to make sure there is enough room          * to push 'argc + 1' elements to the stack. On failure, return error.          * Notice that we need, in worst case, 'argc + 1' elements because we push all the arguments          * given by the user (without the first argument) and we also push the 'redis' global table and          * 'redis.call' function so:          * (1 (redis table)) + (1 (redis.call function)) + (argc - 1 (all arguments without the first)) = argc + 1*/         ldbLogRedisReply("max lua stack reached");         return;     }      lua_getglobal(lua,"redis");     lua_pushstring(lua,"call");     lua_gettable(lua,-2);       /* Stack: redis, redis.call */

Patch:
patch: @@ -128,6 +128,16 @@ void sha1hex(char *digest, char *script, size_t len) {
  */
 
 char *redisProtocolToLuaType(lua_State *lua, char* reply) {
+
+    if (!lua_checkstack(lua, 5)) {
+        /*
+         * Increase the Lua stack if needed, to make sure there is enough room
+         * to push 5 elements to the stack. On failure, exit with panic.
+         * Notice that we need, in the worst case, 5 elements because redisProtocolToLuaType_Aggregate
+         * might push 5 elements to the Lua stack.*/
+        serverPanic("lua stack limit reach when parsing redis.call reply");
+    }
+
     char *p = reply;
 
     switch(*p) {
@@ -220,6 +230,11 @@ char *redisProtocolToLuaType_Aggregate(lua_State *lua, char *reply, int atype) {
             if (atype == '%') {
                 p = redisProtocolToLuaType(lua,p);
             } else {
+                if (!lua_checkstack(lua, 1)) {
+                    /* Notice that here we need to check the stack again because the recursive
+                     * call to redisProtocolToLuaType might have use the room allocated in the stack */
+                    serverPanic("lua stack limit reach when parsing redis.call reply");
+                }
                 lua_pushboolean(lua,1);
             }
             lua_settable(lua,-3);
@@ -339,6 +354,17 @@ void luaSortArray(lua_State *lua) {
 /* Reply to client 'c' converting the top element in the Lua stack to a
  * Redis reply. As a side effect the element is consumed from the stack.  */
 void luaReplyToRedisReply(client *c, lua_State *lua) {
+
+    if (!lua_checkstack(lua, 4)) {
+        /* Increase the Lua stack if needed to make sure there is enough room
+         * to push 4 elements to the stack. On failure, return error.
+         * Notice that we need, in the worst case, 4 elements because returning a map might
+         * require push 4 elements to the Lua stack.*/
+        addReplyErrorFormat(c, "reached lua stack limit");
+        lua_pop(lua,1); // pop the element from the stack
+        return;
+    }
+
     int t = lua_type(lua,-1);
 
     switch(t) {
@@ -362,6 +388,7 @@ void luaReplyToRedisReply(client *c, lua_State *lua) {
          * field. */
 
         /* Handle error reply. */
+        // we took care of the stack size on function start
         lua_pushstring(lua,"err");
         lua_gettable(lua,-2);
         t = lua_type(lua,-1);
@@ -407,6 +434,7 @@ void luaReplyToRedisReply(client *c, lua_State *lua) {
         if (t == LUA_TTABLE) {
             int maplen = 0;
             void *replylen = addReplyDeferredLen(c);
+            /* we took care of the stack size on function start */
             lua_pushnil(lua); /* Use nil to start iteration. */
             while (lua_next(lua,-2)) {
                 /* Stack now: table, key, value */
@@ -429,6 +457,7 @@ void luaReplyToRedisReply(client *c, lua_State *lua) {
         if (t == LUA_TTABLE) {
             int setlen = 0;
             void *replylen = addReplyDeferredLen(c);
+            /* we took care of the stack size on function start */
             lua_pushnil(lua); /* Use nil to start iteration. */
             while (lua_next(lua,-2)) {
                 /* Stack now: table, key, true */
@@ -448,6 +477,7 @@ void luaReplyToRedisReply(client *c, lua_State *lua) {
         void *replylen = addReplyDeferredLen(c);
         int j = 1, mbulklen = 0;
         while(1) {
+            /* we took care of the stack size on function start */
             lua_pushnumber(lua,j++);
             lua_gettable(lua,-2);
             t = lua_type(lua,-1);
@@ -2506,6 +2536,17 @@ void ldbEval(lua_State *lua, sds *argv, int argc) {
 void ldbRedis(lua_State *lua, sds *argv, int argc) {
     int j, saved_rc = server.lua_replicate_commands;
 
+    if (!lua_checkstack(lua, argc + 1)) {
+        /* Increase the Lua stack if needed to make sure there is enough room
+         * to push 'argc + 1' elements to the stack. On failure, return error.
+         * Notice that we need, in worst case, 'argc + 1' elements because we push all the arguments
+         * given by the user (without the first argument) and we also push the 'redis' global table and
+         * 'redis.call' function so:
+         * (1 (redis table)) + (1 (redis.call function)) + (argc - 1 (all arguments without the first)) = argc + 1*/
+        ldbLogRedisReply("max lua stack reached");
+        return;
+    }
+
     lua_getglobal(lua,"redis");
     lua_pushstring(lua,"call");
     lua_gettable(lua,-2);       /* Stack: redis, redis.call */
path: src/scripting.c