Leesh3288

يُعتبر كل من Redis و Valkey عرضة لثغرة أمنية تتمثل في تجاوز سعة المخزن المؤقت (buffer overflow) القائم على الـ heap في وظيفة HyperLogLog. يمكن لمهاجم معتمد استغلال هذه الثغرة عن طريق إرسال سلسلة نصية مصممة خصيصًا، مما قد يؤدي إلى تنفيذ التعليمات البرمجية عن بُعد (RCE). السبب الجذري هو تجاوز سعة عدد صحيح في الدالة `hllMerge()` عند معالجة بيانات HyperLogLog المتفرقة، مما يؤدي إلى الكتابة خارج الحدود. يتوفر استغلال إثبات المفهوم (PoC). تؤثر هذه الثغرة الأمنية على إصدارات Redis 2.8 وما بعدها، حتى الإصدارات 8.0.3 و7.4.5 و7.2.10 و6.2.19 بما في ذلك. كما تتأثر إصدارات Valkey حتى 8.1.3 و8.0.4.

The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading `/proc/self/environ` may provide access equivalent to `--allow-env`, and writing `/proc/self/mem` may provide access equivalent to `--allow-all`. Users who grant read and write access to the entire filesystem may not realize that these accesses to these files may have additional, unintended consequences.

The issue arises from the use of raw file descriptors in `op node ipc pipe()`, leading to the premature close of arbitrary file descriptors. This allows standard input to be closed and re-opened as a different resource, resulting in a permission prompt bypass. An attacker controlling the code executed inside a Deno runtime can exploit this to obtain arbitrary code execution on the host machine, regardless of permissions. The vulnerability is known to be exploitable, with a working exploit that achieves arbitrary code execution by bypassing prompts from zero permissions and abusing the lack of filesystem permission checks in the Cache API. The attack can be conducted silently as stderr can also be closed, suppressing all prompt outputs.

The issue arises from the use of inherently unsafe `*const c void` and `ExternalPointer` which leads to use-after-free access of the underlying structure, resulting in arbitrary code execution. An attacker controlling the code executed inside a Deno runtime can exploit this to obtain arbitrary code execution on the host machine regardless of permissions. The vulnerability is known to be exploitable for both `*const c void` and `ExternalPointer` implementations.

The issue in vm2 allows attackers to escape the sandbox and run arbitrary code, potentially resulting in Remote Code Execution. This is possible due to the Node.js custom inspect function. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. The vulnerability exists because of the lack of measures to neutralize special elements used in the operating system command.