from Hacker News

Redis Lua scripting: several security vulnerabilities fixed

by itamarhaber on 6/13/18, 5:20 PM with 22 comments

  • by mathnmusic on 6/13/18, 5:43 PM

    > Honestly when the Redis Lua engine was designed, it was not conceived with this security model of the customer VS the cloud provider in mind. The assumption kinda was that you can trust who pokes with your Redis server. So in general the Lua libraries were not scrutinized for security. The feeling back then was, if you have access to Redis API, anyway you can do far worse.

    This is an interesting point. Cloud computing and managed/hosted services require a clear separation of what the host can do and what the customer (who's paying for the managed service) should be able to do.

    Just today, our startup decided to use AWS Kinesis (as opposed to setting up Kafka ourselves), despite the vendor lock-in and closed-source nature of AWS components. :-/

  • by samatman on 6/13/18, 6:01 PM

    Consensus in the community is that Lua(JIT) sandboxing must be done on the process level.

    Even with the debug library stripped and other safeguards against (inner) evaluation taken, the trivial DOS of `while true do end` remains.

    If that happens, you want it to live in its own process, or at least its own thread.

  • by breakingcups on 6/13/18, 9:12 PM

    I appreciate the (what feels like) honest and direct communication from Antirez very much. It's always such a breath of fresh air.

  • by moby on 6/13/18, 6:32 PM

    Heroku's updated their Redis fleet: https://blog.heroku.com/redis-vulnerability

  • by ksec on 6/14/18, 7:35 AM

    Somewhat off topic:

    What Happened to the mRuby Scripting in Redis? I remember there were plans to make mRuby in Redis too. Given mRuby has had quite a bit of security audit in recent years that cost Shopify millions.

  • by andrewmcwatters on 6/13/18, 6:34 PM

    > To be fair, I think that the assumptions Lua makes about the stack are a bit too trivial, with the Lua library developer having to constantly check if there is enough space on the stack to push a new value.

    What the fuck? This is almost never a concern for Lua C developers. If you're concerned with LUA_MAXCSTACK defaulted at 2048 and you're running out of space, you're doing something seriously wrong and need to reevaluate how you're using the Lua C API.