Leesh3288

Redis and Valkey are vulnerable to a heap-based buffer overflow in the HyperLogLog functionality. An authenticated attacker can exploit this vulnerability by sending a specially crafted string, potentially leading to remote code execution (RCE). The root cause is an integer overflow in the `hllMerge()` function when processing sparse HyperLogLog data, leading to an out-of-bounds write. A Proof-of-Concept (PoC) exploit is available. The vulnerability affects versions 2.8 and later of Redis, up to and including 8.0.3, 7.4.5, 7.2.10, and 6.2.19. Valkey versions up to 8.1.3 and 8.0.4 are also impacted.

The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading `/proc/self/environ` may provide access equivalent to `--allow-env`, and writing `/proc/self/mem` may provide access equivalent to `--allow-all`. Users who grant read and write access to the entire filesystem may not realize that these accesses to these files may have additional, unintended consequences.

The issue arises from the use of raw file descriptors in `op node ipc pipe()`, leading to the premature close of arbitrary file descriptors. This allows standard input to be closed and re-opened as a different resource, resulting in a permission prompt bypass. An attacker controlling the code executed inside a Deno runtime can exploit this to obtain arbitrary code execution on the host machine, regardless of permissions. The vulnerability is known to be exploitable, with a working exploit that achieves arbitrary code execution by bypassing prompts from zero permissions and abusing the lack of filesystem permission checks in the Cache API. The attack can be conducted silently as stderr can also be closed, suppressing all prompt outputs.

The issue arises from the use of inherently unsafe `*const c void` and `ExternalPointer` which leads to use-after-free access of the underlying structure, resulting in arbitrary code execution. An attacker controlling the code executed inside a Deno runtime can exploit this to obtain arbitrary code execution on the host machine regardless of permissions. The vulnerability is known to be exploitable for both `*const c void` and `ExternalPointer` implementations.

The issue in vm2 allows attackers to escape the sandbox and run arbitrary code, potentially resulting in Remote Code Execution. This is possible due to the Node.js custom inspect function. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. The vulnerability exists because of the lack of measures to neutralize special elements used in the operating system command.