CVE-2022-24736: fedoraproject fedora NULL Pointer Dereference
Vulnerability summary
CVE-2022-24736 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in fedoraproject fedora. EPSS estimates a 1.50% chance of exploitation in the next 30 days, higher than 73.8% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 6 · Related 3Timeline
- 27-04-2022PublishedVulnerability first disclosed.
- 22-04-2025Last modifiedVulnerability information updated.
Description
Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.
CVSS metrics
6 scores · 5 sources · 2 versions- CVE.orgCNA3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · AlpineEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.50%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
0.00 pp
From 1.50% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundRedis
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Netapp2 products
Alpine1 product
- redis< 6.2.7-r0
Debian1 product
- redis< 5:7.0.1-4
Fedoraproject1 product
- fedoraEOL34 | 35 | 36
Oracle1 product
- communications_operations_monitor4.3 | 4.4 | 5.0
Redis1 product
- redis< 7.0.0 | < 6.2.7 | 7.0:rc1 | 7.0:rc2 | 7.0:rc3
Ubuntu1 product
- redisAll versions (No fix recorded)
7 vendors · 8 products
References
15 links- github.com/redis/redis/security/advisories/GHSA-3qpw-7686-5984X Refsource CONFIRMREPORTPatchThird Party Advisory
