Heap-buffer-overflow in mrb_funcall_with_block in mruby
Summary
OSV-2021-1453: Heap-buffer-overflow in mrb_funcall_with_block. Affects mruby versions >= dccd66f9efecd0a974b735c62836fe566015cf37, < 7010ed0f0a414b1367e4620a504f106759341cc2. Fixed in 7010ed0f0a414b1367e4620a504f106759341cc2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embedded in other applications and provides a minimalistic and efficient runtime environment. The mrb_funcall_with_block function in mruby is responsible for calling a Ruby method with a block. This vulnerability, identified as OSV-2021-1453, is a heap-buffer-overflow issue that can lead to a crash or potentially allow an attacker to execute arbitrary code.
Vulnerability Detail
The vulnerability occurs when mrb_funcall_with_block is called with certain parameters, resulting in a heap-buffer-overflow write of 8 bytes. This can lead to memory corruption and potentially allow an attacker to control the execution flow of the program. The crash state indicates that the issue is triggered during the execution of mrb_funcall_id and mrb_equal functions. The severity of this vulnerability is considered HIGH.
How To Fix
Minimum fixed version
7010ed0f0a414b1367e4620a504f106759341cc2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can avoid calling mrb_funcall_with_block with the specific parameters that trigger the vulnerability. It is important to carefully review the code and ensure that the function is not used in a way that could lead to the heap-buffer-overflow. Here is an example of how to avoid the vulnerable usage:
def safe_method_call(mrb, receiver, method, block)
# Check if the method and block are valid
if method && block
# Call the method with the block
mrb.funcall_with_block(receiver, method, block)
else
# Handle the case where the method or block is missing
# ... (alternative code)
end
end
Conclusion
The heap-buffer-overflow vulnerability in mrb_funcall_with_block in mruby can lead to crashes or potential code execution. It is crucial to update the mruby package to a fixed version and review the usage of mrb_funcall_with_block to prevent the vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embedded in other applications and provides a minimalistic and efficient runtime environment.
mrb_funcall_with_block is a function in mruby that is used to call a Ruby method with a block.
A heap-buffer-overflow is a type of memory corruption vulnerability where a program writes data beyond the bounds of a heap-allocated buffer. This can lead to crashes, memory corruption, and potentially allow an attacker to execute arbitrary code.
To fix this vulnerability, you should update the mruby package to a version that includes the fix. Make sure to review the release notes and changelog of the mruby project to identify the version that addresses this specific issue.
Yes, as a workaround, you can avoid calling mrb_funcall_with_block with the specific parameters that trigger the vulnerability. Review your code and ensure that the function is used in a safe manner to prevent the heap-buffer-overflow.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
