FERRAMENTAS LINUX: Critical Valkey Security Update: Patch RCE & DoS Vulnerabilities Immediately (CVE-2025-32023, CVE-2025-48367)

Urgent SUSE Linux Valkey security patch fixes critical Remote Code Execution (CVE-2025-32023) & Denial-of-Service (CVE-2025-48367) vulnerabilities. Learn affected versions (Leap 15.6, SLE 15 SP6), patch commands, CVSS 8.8 risks, and mitigation steps. Secure your Redis-compatible databases now.

Why This Valkey Security Update Demands Immediate Attention

Attention Linux Administrators & DevOps Teams: A newly released SUSE security update (SUSE-SU-2025:02593-1) addresses two critical vulnerabilities in Valkey, the high-performance,

Redis-compatible database. Rated "important," these flaws expose systems to remote code execution (RCE) and client starvation denial-of-service (DoS) attacks. Failure to patch could compromise sensitive data and cripple application availability. Are your mission-critical databases protected?

This comprehensive advisory details the risks, affected systems, and precise remediation steps – essential reading for enterprise infrastructure security.

Critical Vulnerability Analysis: Severity and Impact

CVE-2025-32023: Remote Code Execution via HyperLogLog (CVSS 8.8)

Threat: Attackers exploit an out-of-bounds write flaw in HyperLogLog command processing. This allows authenticated remote attackers to execute arbitrary code on the Valkey server.
Impact: Full system compromise, data theft, unauthorized access, and lateral movement within networks.
CVSS 4.0/3.1 Scores:
- SUSE Assessment: 8.7 (CVSS:4.0) / 8.8 (CVSS:3.1 - AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- NVD Assessment: 7.0 (CVSS:3.1 - AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Technical Insight: This memory corruption vulnerability highlights the risks in complex data structure handling within in-memory databases. Its high complexity rating doesn't negate the severe impact upon exploitation.

CVE-2025-48367: Unauthenticated DoS via IP Protocol Errors (CVSS 7.5)

Threat: Unauthenticated attackers flood Valkey with malicious connections, triggering repeated IP protocol errors. This exhausts server resources, starving legitimate clients and causing service outages.
Impact: Application downtime, degraded performance, loss of service availability, and potential revenue impact.
CVSS 4.0/3.1 Scores:
- SUSE Assessment: 8.7 (CVSS:4.0) / 7.5 (CVSS:3.1 - AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- NVD Assessment: 7.5 (CVSS:3.1 - AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Technical Insight: This resource exhaustion vulnerability underscores the importance of robust connection management and protocol validation in database systems facing public networks.

Affected SUSE Products & Modules

Patch these systems IMMEDIATELY:

openSUSE Leap 15.6
SUSE Linux Enterprise Server 15 SP6 (SLES 15 SP6)
SUSE Linux Enterprise Server for SAP Applications 15 SP6
SUSE Linux Enterprise Real Time 15 SP6
SUSE Module: Server Applications Module 15-SP6

Step-by-Step Patch Installation Guide

Official SUSE Methods (Recommended):

YaST Online Update: Use SUSE's graphical admin tool for seamless patching.
zypper patch Command: The standard command-line method for system-wide updates.

Manual Patch Installation Commands:

openSUSE Leap 15.6:

zypper in -t patch SUSE-2025-2593=1 openSUSE-SLE-15.6-2025-2593=1

Server Applications Module 15-SP6:

zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP6-2025-2593=1

Updated Package Versions

All patched systems utilize version valkey-8.0.2-150600.13.14.1 and related packages:

Product / Module	Architecture	Patched Packages
openSUSE Leap 15.6	aarch64, ppc64le, s390x, x86_64, i586	`valkey-8.0.2-150600.13.14.1`, `valkey-devel-8.0.2-150600.13.14.1`, `valkey-debuginfo-8.0.2-150600.13.14.1`, `valkey-debugsource-8.0.2-150600.13.14.1`
openSUSE Leap 15.6	noarch	`valkey-compat-redis-8.0.2-150600.13.14.1`
Server Applications Module 15-SP6	aarch64, ppc64le, s390x, x86_64	`valkey-8.0.2-150600.13.14.1`, `valkey-devel-8.0.2-150600.13.14.1`, `valkey-debuginfo-8.0.2-150600.13.14.1`, `valkey-debugsource-8.0.2-150600.13.14.1`
Server Applications Module 15-SP6	noarch	`valkey-compat-redis-8.0.2-150600.13.14.1`

Essential References & Source Links

CVE Details:
- CVE-2025-32023 - SUSE Security
- CVE-2025-48367 - SUSE Security
Bug Reports:
- bsc#1246059 (CVE-2025-32023)
- bsc#1246058 (CVE-2025-48367)
Valkey Project: Official Valkey Documentation (Understanding core functionality)

Valkey Security Patch FAQ

Q: Is this Valkey update critical?
A: Absolutely. CVE-2025-32023 (RCE) has a CVSS score up to 8.8, posing a severe risk of complete system takeover. CVE-2025-48367 (DoS) can cripple service availability. Patch immediately.
Q: Does this affect Redis installations?
A: Valkey is a fork of Redis. While this specific advisory is for Valkey on SUSE, all Redis-compatible deployments should monitor their vendors for similar advisories. The underlying flaws could exist elsewhere.
Q: Can I mitigate without patching?
A: Temporary mitigation for CVE-2025-32023 involves restricting HyperLogLog command access via ACLs. Mitigating CVE-2025-48367 requires network-level filtering of malicious traffic. Patching is the definitive solution.
Q: How do I verify patch installation?
A: Run zypper patches or rpm -q valkey to confirm package version 8.0.2-150600.13.14.1 is installed.
Q: Does valkey-compat-redis need updating too?
A: Yes. The compatibility layer is included in the patch (valkey-compat-redis-8.0.2-150600.13.14.1) and must be updated alongside the main Valkey package.

Urgent Call to Action: Secure Your Infrastructure

These Valkey vulnerabilities represent significant risks to data integrity and system availability. The time to act is now. Delaying this update leaves critical systems exposed to sophisticated attacks targeting in-memory databases – a prime target for threat actors.

Next Steps:

Prioritize: Identify all affected SUSE systems immediately.
Patch: Apply the update using zypper or YaST during your next maintenance window or sooner.
Verify: Confirm successful installation and monitor system logs.
Review: Audit Valkey/Redis configurations and network access controls. (Explore our guide on hardening in-memory databases for deeper security).

Proactive patching remains the cornerstone of robust enterprise security. Protect your data, ensure uptime, and maintain trust – apply this critical Valkey security update today.