Heap-buffer-overflow in mrb_bint_cmp in mruby
Summary
OSV-2022-605: Heap-buffer-overflow in mrb_bint_cmp. Affects mruby versions >= 714e8a57af690805b3edcffdffc42729833bc50a, < b84bca666fdc4fe94286b49b6f6b9a64e4c3a534. Fixed in b84bca666fdc4fe94286b49b6f6b9a64e4c3a534. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embedded in other software and provides a minimalistic and efficient runtime environment. The mrb_bint_cmp function in mruby is responsible for comparing big integers. However, a vulnerability has been discovered in this function that can lead to a heap-buffer-overflow read of 8 bytes.
Vulnerability Detail
The vulnerability in mrb_bint_cmp can be triggered when comparing big integers. It results in a heap-buffer-overflow read of 8 bytes. An attacker could potentially exploit this vulnerability to read sensitive information from the heap or cause a denial-of-service condition. The vulnerability was reported through the OSS-Fuzz project and has been assigned a medium severity rating.
How To Fix
Minimum fixed version
b84bca666fdc4fe94286b49b6f6b9a64e4c3a534
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the mruby package to a patched version.
Conclusion
In conclusion, a heap-buffer-overflow vulnerability has been discovered in the mrb_bint_cmp function of the mruby package. This vulnerability can potentially lead to the disclosure of sensitive information or a denial-of-service condition. It is crucial to update the mruby package to a version that includes the fix to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is a lightweight implementation of the Ruby programming language designed for embedding in other software.
This vulnerability can potentially lead to the disclosure of sensitive information or a denial-of-service condition.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software.
This vulnerability has been assigned a medium severity rating.
No, there is no known workaround. It is recommended to update the mruby package to a patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
