Debian-specific Redis Server Lua Sandbox Escape Vulnerability (CVE-2022-0543)

What is affected, what to do

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Debian Redis 5:5.0.14-1+deb10u2..*
• Debian Redis 5:6.0.16-1+deb11u2..*

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Apply the vendor patch: on Debian/Ubuntu run apt-get update && apt-get install --only-upgrade redis-server (fixed in Debian redis 5:5.0.14-1+deb10u2 and 5:6.0.16-1+deb11u2). Replace Bitnami Redis containers with the current image rather than restarting the old pod.
   • Inventory every Redis instance: ss -tlnp | grep 6379, scan the container registry for bitnami/redis tags, and check Helm/Terraform for pinned old image digests.
   • Cut network exposure immediately: block 6379/tcp (and 6380, 16379, 26379 for Sentinel/Cluster) at the perimeter firewall and security groups; whitelist only internal backend subnets. Treat any internet-reachable Redis as already compromised.
   • Disable Lua scripting as a bridging control: in redis.conf set rename-command EVAL "" and rename-command EVALSHA "", then restart. If applications genuinely need Lua, rename to an unpredictable token instead of the empty string.
   • Harden authentication: set a strong requirepass, enforce protected-mode yes, bind to loopback or a dedicated management NIC. Shut down any passwordless default deployment now.
   • Triage exposed hosts: check the redis-server process tree for shell children (sh, bash, curl, wget, python), inspect /tmp, the Redis data dir and ~redis/.ssh/authorized_keys for dropped binaries, cron entries and injected SSH keys.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: place Redis in a dedicated backend VLAN with zero-trust ingress from app tiers only. Egress filtering must block the redis-server process from reaching 80/443, SSH or arbitrary high ports — downloading miners or reverse shells is the standard post-exploitation move.
   • WAF/API gateway: if end-user input ever reaches an EVAL/EVALSHA path, deny Lua payloads containing package, require, io, os or ffi at the application boundary.
   • Container hardening: run Bitnami Redis with readOnlyRootFilesystem: true, non-root UID, allowPrivilegeEscalation: false, the runtime/default seccomp profile, and a Kubernetes NetworkPolicy that only permits the application pods to reach 6379.
   • Host hardening: deploy an AppArmor or SELinux profile that forbids execve of shells for redis-server. Extend the systemd unit with NoNewPrivileges=true, ProtectSystem=strict, PrivateTmp=true.
   • IAM / least privilege: redis service account must have /usr/sbin/nologin, no sudo rights, and no write access to /etc/cron.* or /var/spool/cron. Config files owned by root, mode 0644.
   • Config-change control: rename CONFIG SET via rename-command or restrict it to an admin jump host, so an attacker cannot pivot dir/dbfilename to a writable path for webshell staging.
3. 03

   Runbook step 3

   Detection rules

   • Sysmon EID 1 / auditd execve: parent process redis-server spawning sh, bash, dash, python, perl, curl, wget or nc — a near-zero-false-positive exploitation signal. Sigma shape: parent_image|endswith: 'redis-server' and image|endswith: ('/sh','/bash','/curl','/wget','/python3').
   • Network telemetry (Zeek/Suricata): inbound connections to 6379 from unexpected sources; outbound traffic from the Redis host to mining pools, pastebin, raw.githubusercontent.com or IP-literal URLs. Suricata idea: alert on TCP payload containing EVAL plus package.loadlib or io.popen.
   • Redis slowlog and periodic MONITOR sampling: Lua scripts invoking redis.call('CONFIG','SET','dir',...) or cjson/cmsgpack payloads with shell metacharacters. KQL shape: DeviceProcessEvents | where InitiatingProcessFileName == "redis-server" and FileName in ("sh","bash","curl","wget").
   • File-system auditing (auditd -w): writes to /var/spool/cron/, /etc/cron.d/ or ~/.ssh/authorized_keys by the redis UID — the classic persistence pattern after a sandbox escape.
   • Application and web logs: error spikes or latency anomalies on endpoints that trigger Redis Lua, correlated with CPU surges on Redis hosts — a strong indicator of crypto-miner payloads, the most common post-exploitation outcome.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

Source: Debian Security Advisories, NVD (NIST), schneider_csaf, cvelistv5, CISA KEV Catalog, OSV (Open Source Vulnerabilities), CVE.org (MITRE)

Vendors and products

• Debian Redis
• Redis Redis

Weakness classes (CWE)

• CWE-862Missing Authorization

  Class

  The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

  Entry at MITRE CWE-862

References & sources

• packetstormsecurity.comfiles/166885/Redis-Lua-Sandbox-Escape.htmlweb, x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• bugs.debian.org1005787web, x_refsource_MISC, Issue tracking, Patch, Third-party advisory
• lists.debian.org[debian-security-announce] 20220218 [SECURITY] [DSA 5081-1] redis security updateweb, Mailing list, x_refsource_MLIST, Mailing list, Third-party advisory
• security.netapp.comadvisory/ntap-20220331-0004web, x_refsource_CONFIRM, Third-party advisory
• debian.orgDSA-5081web, Vendor advisory, x_refsource_DEBIAN, Mailing list, Third-party advisory
• ubercomp.composts/2022-01-20_redis_on_debian_rceweb, x_refsource_MISC, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0543government-resource, US government resource