Ruby Vulnerability: Heap Data Exposure in BasicSocket#read_nonblock
Summary
ALPINE-CVE-2020-10933: An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. Affects ruby versions < 2.5.8-r0. Fixed in 2.5.8-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is a dynamic, open-source programming language with a focus on simplicity and productivity. It has an elegant syntax that is natural to read and easy to write. The Ruby package in Alpine Linux provides the Ruby interpreter and standard libraries. This vulnerability affects Ruby versions 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0, allowing potential exposure of sensitive data from the heap memory.
Vulnerability Detail
An issue was discovered in Ruby versions 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. When a user calls the BasicSocket#read_nonblock method with parameters that include a buffer and exception set to false, the method resizes the buffer to accommodate the requested size without copying any data. As a result, the buffer retains the previous value from the heap, which may inadvertently expose sensitive information from the Ruby interpreter's memory.
How To Fix
Minimum fixed version
2.5.8-r0
This is the first release that contains the fix.
sudo apk add --upgrade rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the BasicSocket#read_nonblock method with the exception parameter set to false until the package is updated to a secure version.
Conclusion
The Ruby vulnerability identified as CVE-2020-10933 poses a risk of exposing sensitive heap data through the BasicSocket#read_nonblock method. It is crucial to update to the patched versions of Ruby to mitigate this risk and ensure the security of applications using this interpreter.
See every vulnerability recorded for ruby →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a medium severity level.
Ruby versions 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0 are affected.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, refrain from using the BasicSocket#read_nonblock method with the exception parameter set to false as a temporary measure.
More details can be found in the CVE-2020-10933 documentation and the Alpine Linux vulnerability database.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
