Stack Overflow in FalkorDB Redis Module

Executive Summary

FalkorDB versions 4.20.1 to 4.20.4 contain a stack overflow vulnerability in the _ValidateUnion_Clauses function located in the ast_validations.c file. This flaw allows attackers to trigger a Denial of Service (DoS) condition by sending specially crafted input to the system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to FalkorDB and involves a stack overflow in the _ValidateUnion_Clauses function. Detection requires checking the FalkorDB version running on your system. If you are running versions v4.20.1 to v4.20.4, the system is vulnerable. Use the command 'redis-cli info modules' to check the installed FalkorDB version.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause your FalkorDB instance to crash or become unresponsive, leading to service disruption. Since it is a DoS issue, attackers could exploit it to take down your database server by sending malicious queries, affecting availability of your application or service.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a Denial of Service (DoS) via stack overflow, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems. Compliance may require mitigating such vulnerabilities to ensure continuous protection of regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FalkorDB to a version that fixes the stack overflow issue in _ValidateUnion_Clauses. Specifically, update to a version beyond v4.20.4 to address the vulnerability.

Useful 0 Not Useful 0