Heap-buffer-overflow in mrb_vm_exec in mruby
Summary
OSV-2021-1340: Heap-buffer-overflow in mrb_vm_exec. Affects mruby versions >= b1b9b157f85fe371db706e0c11024681d84e4aba, < 0455313a9bdbe93556a8fd31b7c011dd004a6f2b. Fixed in 0455313a9bdbe93556a8fd31b7c011dd004a6f2b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embedded in other applications and provides a minimalistic and efficient Ruby interpreter. The vulnerability in mrb_vm_exec function can lead to a heap-buffer-overflow when executing certain code. This can potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition.
Vulnerability Detail
The vulnerability arises due to a heap-buffer-overflow in the mrb_vm_exec function of mruby. When executing certain code, there is a read access beyond the bounds of a heap buffer. This can result in memory corruption, leading to various consequences such as arbitrary code execution or crashing the interpreter. The vulnerability was reported through the OSS-Fuzz project and has been assigned the identifier OSV-2021-1340.
How To Fix
Minimum fixed version
0455313a9bdbe93556a8fd31b7c011dd004a6f2b
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can review and modify the code to ensure that the mrb_vm_exec function is not called with inputs that trigger the heap-buffer-overflow. This may involve validating and sanitizing user inputs or implementing additional bounds checks. Here is an example of how bounds checking can be added:
void my_mrb_vm_exec(mrb_state *mrb, struct mrb_vm *vm) {
if (vm->pc >= vm->ci->pcend) {
// Handle out-of-bounds access
return;
}
// Rest of the function
}
Conclusion
In conclusion, the mrb_vm_exec function in mruby is vulnerable to a heap-buffer-overflow, which can have serious security implications. It is crucial to update to a fixed version of mruby or apply the recommended workarounds to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is a lightweight implementation of the Ruby programming language designed for embedding in other applications.
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software.
Yes, a fix for this vulnerability has been implemented in commit 0455313a9bdbe93556a8fd31b7c011dd004a6f2b. Updating to a version of mruby that includes this commit or any subsequent version should resolve the issue.
Developers can implement additional bounds checks or input validation to mitigate the risk of triggering the heap-buffer-overflow.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
