Redis 7.4.2 HyperLogLog out-of-bounds write

Redis 7.4.2 has an integer overflow in HyperLogLog sparse encoding that can lead to an out-of-bounds write. The playbook builds 7.4.2 from source, binds to all interfaces with protected mode off and no password, re-enables the DEBUG and MODULE commands, and runs the server as root under systemd. Good for practising config review and patch checks.

Remote code execution bugs are the ones defenders care about most. This target is useful for testing detection rules and logging.

Product

Redis

Version

7.4.2

Type

RCE

Severity

High

Port

6379/tcp

This playbook needs the setup from the earlier steps. Check these first.

• The base VM from Step 01 is built and reachable over SSH.
• You cloned the playbooks repo and set inventory/hosts.ini in Step 02.
• A snapshot named clean-base exists, and the machine is booted from it.

One CVE at a time. Don't run this on top of another playbook. Reset first.

Boot the machine from clean-base, then run the playbook for CVE-2025-32023. It installs Redis 7.4.2, sets up its config and starts the service.

ansible-playbook cve/cve-2025-32023.yml 

A clean run ends with a recap that shows failed=0. If it fails partway, run it again.

The verify tag checks that the service is listening and running the version this CVE affects. Run it from the host.

ansible-playbook cve/cve-2025-32023.yml  --tags verify

You should see target OK.

- Redis reachable from untrusted networks, or running with no requirepass set - HyperLogLog commands (PFADD, PFMERGE, PFDEBUG) from unexpected clients - Use of DEBUG, MODULE or CONFIG SET commands - redis-server starting child processes or loading unknown modules - A version string of 7.4.2 in INFO output

Fixed in Redis 8.0.3, 7.4.5, 7.2.10 and 6.2.19, which add the missing size checks in HyperLogLog sparse encoding. Upgrade, bind Redis to trusted interfaces only, and set a password.

Restore clean-base. Nothing from this playbook carries over.

VBoxManage controlvm thehackingmachine acpipowerbutton
VBoxManage snapshot thehackingmachine restore clean-base
VBoxManage startvm thehackingmachine

• https://nvd.nist.gov/vuln/detail/CVE-2025-32023
• https://github.com/redis/redis/security/advisories

Playbook and write-up by TheHackingMachine Team.

Want to add your own? See how to contribute.