AVID-2026-R1440

Description

RedisBloom heap buffer overflow in CF.LOADCHUNK command (CVE-2024-25115)

Details

RedisBloom adds a set of probabilistic data structures to Redis. Starting in version 2.0.0 and prior to version 2.4.7 and 2.6.10, specially crafted CF.LOADCHUNK commands may be used by authenticated users to perform heap overflow, which may lead to remote code execution. The problem is fixed in RedisBloom 2.4.7 and 2.6.10.

Reason for inclusion in AVID: CVE-2024-25115 describes a heap-based buffer overflow in RedisBloom (a Redis module) that could allow authenticated users to achieve remote code execution. RedisBloom is a software component used to provide probabilistic data structures within Redis, and Redis-based deployments are commonly part of AI/ML data processing, feature pipelines, caching, and model serving stacks. Thus, this vulnerability is in a software component that can be part of the supply chain for general-purpose AI systems. The issue is a security vulnerability (RCE risk) with clear evidence and fixes in newer versions, and the report includes explicit CVE details and references.

References

Affected or Relevant Artifacts

Developer: RedisBloom
Deployer: RedisBloom
Artifact Details:

Type	Name
System	RedisBloom

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score	7.0
Base Severity	🔴 High
Attack Vector	LOCAL
Attack Complexity	🔴 High
Privileges Required	🟢 Low
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	🔴 High
Integrity Impact	🔴 High
Availability Impact	🔴 High

CWE

ID	Description
CWE-122	CWE-122: Heap-based Buffer Overflow
CWE-120	CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)

Other information

Report Type: Advisory
Credits:
Date Reported: 2024-04-09
Version: 0.3.3
AVID Entry