Out-of-Bounds Read in FalkorDB Redis Module

Executive Summary

This is an out-of-bounds read vulnerability in FalkorDB, a Redis module. It exists in the node_token_count/relation_token_count component versions 4.20.1 to 4.20.4. The flaw allows attackers to cause a Denial of Service by providing specially crafted input that reads beyond allocated memory.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to FalkorDB versions 4.20.1 to 4.20.4 and involves an out-of-bounds read in the node_token_count/relation_token_count component. Detection requires checking the installed version of FalkorDB and monitoring for crashes or errors related to token counting operations.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can crash the FalkorDB service, leading to service disruption. Since FalkorDB is a Redis module, the Redis server may also become unavailable, affecting all dependent applications and services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a Denial of Service (DoS) via out-of-bounds read, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems. Compliance may be compromised if systems fail to maintain required uptime or data integrity due to DoS conditions.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FalkorDB to a version beyond v4.20.4 to address the out-of-bounds read vulnerability in node_token_count/relation_token_count.

Useful 0 Not Useful 0