CVE-2023-45145 : What You Need to Know

This article provides detailed information about CVE-2023-45145, a vulnerability affecting Redis Unix domain socket permissions.

Understanding CVE-2023-45145

This CVE involves Redis, an in-memory database that persists on disk, and the exposure of Unix domain sockets with incorrect permissions.

What is CVE-2023-45145?

Redis, starting from version 2.6.0-RC1, may briefly expose Unix domain sockets with incorrect permissions due to a race condition when using a permissive umask(2). This could allow unauthorized processes to establish connections during this window.

The Impact of CVE-2023-45145

The vulnerability allows unauthorized access to Redis Unix domain sockets, potentially leading to information disclosure or unauthorized actions. It affects Redis versions 2.6.0-RC1 to 6.2.14, 7.0.0 to 7.0.14, and 7.1.0 to 7.2.2.

Technical Details of CVE-2023-45145

This section delves into the vulnerability description, affected systems, and the exploitation mechanism.

Vulnerability Description

Redis exposes Unix domain sockets with incorrect permissions, potentially enabling unauthorized connections during a short time window due to a permissive umask(2).

Affected Systems and Versions

Redis versions >= 2.6.0-RC1, < 6.2.14
Redis versions >= 7.0.0, < 7.0.14
Redis versions >= 7.1.0, < 7.2.2 All these versions are impacted by the CVE.

Exploitation Mechanism

The vulnerability arises from a race condition created by the use of a permissive umask(2), enabling unauthorized processes to briefly establish connections to Redis Unix domain sockets.

Mitigation and Prevention

In this section, we cover immediate steps to take, long-term security practices, and the importance of patching and updates.

Immediate Steps to Take

Upgrade Redis to versions 7.2.2, 7.0.14, or 6.2.14 to mitigate the vulnerability.
Disable Unix sockets if upgrading is not immediately possible.
Start Redis with a restrictive umask or store the socket file in a secure directory.

Long-Term Security Practices

Regularly update Redis and implement secure configurations to prevent unauthorized access to Unix domain sockets.

Patching and Updates

Stay informed about security advisories and apply patches promptly to protect against known vulnerabilities.