Heap-buffer-overflow in heredoc_remove_indent in mruby
Summary
OSV-2021-392: Heap-buffer-overflow in heredoc_remove_indent. Affects mruby versions >= 0d22e11b757c6fe9b30e55cb7d83ab7421575968, < 94fb86f89b131814201596d301f584dfe4547526. Fixed in 94fb86f89b131814201596d301f584dfe4547526. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embedded in other applications to provide scripting capabilities. The vulnerability in question, identified as OSV-2021-392, is a heap-buffer-overflow that occurs in the heredoc_remove_indent function of mruby. This function is responsible for removing indentation from heredoc strings. The vulnerability can be triggered when parsing a string, leading to a heap-buffer-overflow read. The issue was reported through the OSS-Fuzz project.
Vulnerability Detail
The heap-buffer-overflow vulnerability in heredoc_remove_indent can potentially be exploited by an attacker to read beyond the bounds of a heap buffer. This can result in the disclosure of sensitive information or the execution of arbitrary code. The vulnerability is considered to have a medium severity level. The crash state indicates that the issue occurs during the parsing of a string, specifically in the parser_yylex function. The vulnerability was introduced in commit 0d22e11b757c6fe9b30e55cb7d83ab7421575968 and fixed in commit 94fb86f89b131814201596d301f584dfe4547526.
How To Fix
Minimum fixed version
94fb86f89b131814201596d301f584dfe4547526
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can avoid using heredoc strings in their code or ensure that the strings do not trigger the vulnerable code path. This can be achieved by modifying the indentation of the heredoc strings or using alternative string formatting methods.
Conclusion
In conclusion, the mruby package is affected by a heap-buffer-overflow vulnerability in the heredoc_remove_indent function. This vulnerability can be exploited to read beyond the bounds of a heap buffer, potentially leading to the disclosure of sensitive information or the execution of arbitrary code. It is recommended to update the package to a version that includes the fix commit 94fb86f89b131814201596d301f584dfe4547526. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is an open-source lightweight implementation of the Ruby programming language that can be embedded in other applications.
A heap-buffer-overflow vulnerability occurs when a program reads or writes data beyond the bounds of a heap buffer, potentially leading to information disclosure or arbitrary code execution.
An attacker can exploit this vulnerability by crafting a malicious input that triggers the vulnerable code path, causing a heap-buffer-overflow read.
This vulnerability is considered to have a medium severity level.
To fix this vulnerability, update the mruby package to a version that includes the fix commit 94fb86f89b131814201596d301f584dfe4547526.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
