Heap-buffer-overflow in mrb_funcall_with_block in mruby
Summary
OSV-2021-1452: Heap-buffer-overflow in mrb_funcall_with_block. Affects mruby versions >= dccd66f9efecd0a974b735c62836fe566015cf37, < 7010ed0f0a414b1367e4620a504f106759341cc2. Fixed in 7010ed0f0a414b1367e4620a504f106759341cc2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embedded in other applications and provides a minimalistic and efficient runtime environment. The mrb_funcall_with_block function in mruby is responsible for invoking Ruby methods with a block. However, a vulnerability has been discovered in this function that can lead to a heap-buffer-overflow write of 8 bytes.
Vulnerability Detail
The vulnerability arises due to a heap-buffer-overflow write of 8 bytes in the mrb_funcall_with_block function. This can be triggered when invoking Ruby methods with a block. An attacker could potentially exploit this vulnerability to overwrite adjacent memory locations, leading to arbitrary code execution or a denial of service. The vulnerability has been assigned a severity rating of HIGH.
How To Fix
Minimum fixed version
7010ed0f0a414b1367e4620a504f106759341cc2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can avoid using the mrb_funcall_with_block function until the package is updated with the fix. Instead, they can use alternative methods or refactor their code to achieve the desired functionality without relying on mrb_funcall_with_block.
Conclusion
In conclusion, a heap-buffer-overflow vulnerability has been discovered in the mrb_funcall_with_block function in the mruby package. This vulnerability can be mitigated by updating to a version of mruby that includes the fix or by avoiding the use of mrb_funcall_with_block until the package is updated. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is an open-source lightweight implementation of the Ruby programming language designed to be embedded in other applications.
The mrb_funcall_with_block function in mruby is responsible for invoking Ruby methods with a block.
A heap-buffer-overflow is a type of memory vulnerability where a program writes data beyond the bounds of a dynamically allocated buffer in the heap.
This vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial of service by overwriting adjacent memory locations.
This vulnerability has been assigned a severity rating of HIGH.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
