Heap-buffer-overflow in mrb_bint_to_s in mruby
Summary
OSV-2022-578: Heap-buffer-overflow in mrb_bint_to_s. Affects mruby versions >= 872020bb3d85ba4066ec19cfcad375e51fdf024b, < 37c2f080f09390105956edb2565627f29281e24e. Fixed in 37c2f080f09390105956edb2565627f29281e24e. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embeddable in other applications and provides a simple and efficient way to execute Ruby code. This vulnerability affects the mrb_bint_to_s function in mruby, which is responsible for converting a binary integer to a string representation. The vulnerability allows for a heap-buffer-overflow write, potentially leading to a crash or arbitrary code execution.
Vulnerability Detail
The vulnerability arises due to a heap-buffer-overflow write in the mrb_bint_to_s function. This can be triggered when converting a binary integer to a string representation. An attacker could exploit this vulnerability by providing a specially crafted input, leading to a buffer overflow and potential code execution. The vulnerability has been assigned a severity rating of HIGH.
How To Fix
Minimum fixed version
37c2f080f09390105956edb2565627f29281e24e
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at this time.
Conclusion
In conclusion, the mrb_bint_to_s function in mruby is vulnerable to a heap-buffer-overflow write. Users are advised to update their mruby installation to a version that includes the fix or apply the necessary patch. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is a lightweight implementation of the Ruby programming language designed for embedding in other applications.
This vulnerability can lead to a heap-buffer-overflow write, potentially resulting in a crash or arbitrary code execution.
To fix this vulnerability, update the mruby package to a version that includes the fix.
There is currently no known workaround for this vulnerability.
For more information about this vulnerability, refer to the provided OSS-Fuzz report and the source link in the database-specific section.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
