Redis blocking list traversal triggers heap use-after-free leading to remote code execution
The vulnerability lies in the underlying logic that wakes blocked clients. When multiple clients block waiting on the same key, the server iterates the blocked list and resumes client command execution in turn. If the eviction mechanism fires during this process, connection resources for subsequent clients are forcibly released while the iterator still holds references to the freed list nodes, producing a heap use-after-free condition. An attacker can construct a race condition over the network with crafted blocking commands combined with memory threshold configuration, and exploit the memory corruption to hijack control flow without any authentication. Affected systems face arbitrary code execution and process termination, severely disrupting business continuity.
- It is recommended to manage dynamic memory lifecycles automatically with smart pointers or reference counting, use snapshot copies or deferred safe deletion when iterating container structures to avoid iterator invalidation, strictly validate object state flags with null and validity assertions before access, and periodically review pointer dereference paths with static analysis to eliminate dangling references.
