Heap-buffer-overflow in mrb_bint_add in mruby
Summary
OSV-2022-606: Heap-buffer-overflow in mrb_bint_add. Affects mruby versions >= 714e8a57af690805b3edcffdffc42729833bc50a, < b84bca666fdc4fe94286b49b6f6b9a64e4c3a534. Fixed in b84bca666fdc4fe94286b49b6f6b9a64e4c3a534. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embeddable in other applications and provides a simple and efficient way to execute Ruby code. The mrb_bint_add function in mruby is responsible for performing addition operations on big integers. However, a vulnerability has been discovered in this function that can lead to a heap-buffer-overflow read of 8 bytes.
Vulnerability Detail
The vulnerability in mrb_bint_add can be triggered when performing addition operations on big integers. It results in a heap-buffer-overflow read of 8 bytes. An attacker could potentially exploit this vulnerability to read sensitive information from the heap or cause a denial-of-service condition. The vulnerability was reported through the OSS-Fuzz project and has been assigned a medium severity rating.
How To Fix
Minimum fixed version
b84bca666fdc4fe94286b49b6f6b9a64e4c3a534
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the mruby package to a fixed version as soon as possible.
Conclusion
In conclusion, a heap-buffer-overflow vulnerability has been discovered in the mrb_bint_add function of the mruby package. This vulnerability can be exploited to read sensitive information or cause a denial-of-service condition. It is crucial to update the mruby package to a fixed version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is a lightweight implementation of the Ruby programming language that can be embedded in other applications.
This vulnerability can potentially be exploited to read sensitive information from the heap or cause a denial-of-service condition.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software.
This vulnerability has been assigned a medium severity rating.
No, there is no known workaround for this vulnerability. It is recommended to update the mruby package to a fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
