Redis: redis: out-of-bounds read via crafted cluster bus packets

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).

The product reads data past the end, or before the beginning, of the intended buffer.

An attacker operating through an adjacent network may attempt exploitation without authentication or user interaction. If successful, the issue may obtain information outside the intended access boundary.