Heap-double-free vulnerability in mruby
Summary
OSV-2020-744: Heap-double-free in mrb_default_allocf. Affects mruby versions >= 9cdf439db52b66447b4e37c61179d54fad6c8f33, < 97319697c8f9f6ff27b32589947e1918e3015503. Fixed in 97319697c8f9f6ff27b32589947e1918e3015503. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embedded in other applications and provides a minimalistic and efficient runtime environment. The vulnerability in question is a heap-double-free issue that was discovered through OSS-Fuzz testing.
Vulnerability Detail
The vulnerability arises from a heap-double-free condition in the mrb_default_allocf function of mruby. This can lead to a crash due to the freeing of the same memory block twice. An attacker could potentially exploit this issue to execute arbitrary code or cause a denial of service. The vulnerability has been assigned a high severity level.
How To Fix
Minimum fixed version
97319697c8f9f6ff27b32589947e1918e3015503
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to keep software and dependencies up to date to minimize the risk of known vulnerabilities.
Conclusion
The heap-double-free vulnerability in mruby can potentially lead to crashes, code execution, or denial of service. It is important to update to a version of mruby that includes the fix to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is a lightweight implementation of the Ruby programming language that is designed to be embedded in other applications.
The vulnerability occurs when the mrb_default_allocf function in mruby frees the same memory block twice, leading to a crash or potential code execution.
This vulnerability has been assigned a high severity level.
Yes, a fix has been implemented in commit 97319697c8f9f6ff27b32589947e1918e3015503. It is recommended to update to a version of mruby that includes this fix.
There are no specific workarounds mentioned for this vulnerability. Keeping software and dependencies up to date is generally a good practice to minimize the risk of known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
