Arbitrary Memory Exposure in Ruby
Summary
CVE-2017-14064: Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. Affects ruby across 16 version ranges.
< 2.4.2-r0
< 4bd69735af901266ec21486243fc206030caa6b9
< 8f782fd8e181d9cfe9387ded43a5ca9692266b85
< 9d222264d5e6a2dcac5aceafb5742a65e53dc513
< 55b2febff000595e6c5d8120ccb888855b7edb6f
< 5827d8e887d881eb3a6e6ea7410590261c90545f
< 8183c0532207ad0a9b9f99b659116218a9fa132b
< 81234c5ecaab58e03e346ebdbf5678e4b8a3db55
< 530165c2948c3eed741db5659f7b937270caa46a
< 820605ba3c10b9f4dafc4e5d6e09765b8b31cbea
< 9993701c7d3d83e24699177fef3238d8bf7bbbab
< c91cb76f8d84b2963f6ede2ef445ad46a6104216
< d4bb726b713658f56e630b6cf817a0155b6f390e
< d40ea2afa6ff5a6e5befcf342fb7b6dc58796b20
< e11c22602af69e8139ec0649bb39f5a66d1e66a1
< e3434401aca2e331132652d4458366267e8cf378
Fixed in 2.4.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is a dynamic, open-source programming language known for its simplicity and productivity. It is widely used for web development, scripting, and system administration tasks. However, versions 2.2.7 through 2.4.1 of Ruby are susceptible to an arbitrary memory exposure vulnerability during a JSON.generate call.
Vulnerability Detail
The vulnerability arises from the use of strdup in ext/json/ext/generator/generator.c, which stops after encountering a '\0' byte. This results in a pointer to a string of length zero, which does not match the stored length in space_len. An attacker can exploit this flaw to expose arbitrary memory contents, potentially leading to sensitive information disclosure or remote code execution.
How To Fix
Minimum fixed version
2.4.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Ruby is not immediately feasible, a potential workaround is to avoid using the JSON.generate method in a way that could trigger the vulnerability. Instead, consider using alternative JSON serialization libraries or functions that are not affected by this issue.
Conclusion
The arbitrary memory exposure vulnerability in Ruby versions 2.2.7 through 2.4.1 can have severe consequences, including the exposure of sensitive information and potential remote code execution. It is crucial to update Ruby to version 2.4.2-r0 or later to mitigate this vulnerability. If immediate updating is not possible, consider using alternative JSON serialization methods or libraries. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ruby →
FAQ
The vulnerability can allow an attacker to access arbitrary memory contents, potentially leading to the exposure of sensitive information or the execution of malicious code.
Versions 2.2.7 through 2.4.1 of Ruby are affected by this vulnerability.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is crucial to apply the recommended fix to mitigate any potential risks.
A possible workaround is to avoid using the JSON.generate method in a way that triggers the vulnerability. However, updating Ruby to the patched version is the recommended solution.
You can find more detailed information about this vulnerability, including its technical aspects and impact, in the official CVE-2017-14064 report.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
