Heap-buffer-overflow in mrb_vm_exec in mruby
Summary
OSV-2022-603: Heap-buffer-overflow in mrb_vm_exec. Affects mruby versions >= 872020bb3d85ba4066ec19cfcad375e51fdf024b, < 2b074893723ebb335e6469c34caa2d8eac05d6ed. Fixed in 2b074893723ebb335e6469c34caa2d8eac05d6ed. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embedded in other applications and provides a minimalistic and efficient runtime environment. The mrb_vm_exec function is responsible for executing bytecode instructions in the mruby virtual machine. However, a vulnerability has been discovered in this function that can lead to a heap-buffer-overflow write of 8 bytes.
Vulnerability Detail
The vulnerability occurs when executing bytecode instructions in the mruby virtual machine. It is triggered by a heap-buffer-overflow write of 8 bytes. An attacker could exploit this vulnerability to overwrite adjacent memory locations, potentially leading to arbitrary code execution or a denial-of-service condition. The vulnerability has been assigned a severity rating of HIGH.
How To Fix
Minimum fixed version
2b074893723ebb335e6469c34caa2d8eac05d6ed
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the mruby package to a fixed version as soon as possible.
Conclusion
In conclusion, a heap-buffer-overflow vulnerability has been discovered in the mrb_vm_exec function of the mruby package. This vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition. It is recommended to update the mruby package to a version that includes the fix for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is an open-source lightweight implementation of the Ruby programming language that is designed to be embedded in other applications.
The mrb_vm_exec function is responsible for executing bytecode instructions in the mruby virtual machine.
A heap-buffer-overflow is a type of memory corruption vulnerability where a program writes data beyond the bounds of a heap-allocated buffer.
This vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition.
This vulnerability has been assigned a severity rating of HIGH.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
