Segv on unknown address in mpz_add in mruby
Summary
OSV-2022-621: Segv on unknown address in mpz_add. Affects mruby versions >= e04184185ab43b94980550e850d8813a415fa438, < 26ce85bd5de515906e01fdeeac774316628ad599. Fixed in 26ce85bd5de515906e01fdeeac774316628ad599. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embedded in other applications and provides a minimalistic and efficient runtime environment. The mpz_add function in mruby is responsible for adding two multiple-precision integers. This vulnerability in mpz_add can lead to a segmentation fault (segv) when encountering an unknown address.
Vulnerability Detail
The vulnerability in mpz_add arises from a segmentation fault on an unknown address. This can occur during the execution of the mrb_bint_add function, which is called by int_add. The exact cause of the segv is not specified in the provided information. However, it is important to note that a segv can result in a program crash or potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition.
How To Fix
Minimum fixed version
26ce85bd5de515906e01fdeeac774316628ad599
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround is mentioned in the provided information. However, if updating the mruby package is not immediately feasible, it is advisable to review the code that utilizes mpz_add and ensure proper input validation and error handling to mitigate the risk of encountering the segv.
Conclusion
In conclusion, the vulnerability in mpz_add in mruby can result in a segv on an unknown address, potentially leading to a program crash or exploitation by an attacker. It is crucial to update the mruby package to a version that includes the fix or implement proper input validation and error handling in the code utilizing mpz_add. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is a lightweight implementation of the Ruby programming language designed for embedding in other applications.
mpz_add is a function in mruby responsible for adding two multiple-precision integers.
A segmentation fault (segv) is a type of error that occurs when a program tries to access a memory location that it is not allowed to access, resulting in a crash.
The segv on an unknown address in mpz_add can lead to a program crash or potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition.
To fix this vulnerability, update the mruby package to a version that includes the fix in commit 26ce85bd5de515906e01fdeeac774316628ad599 of the mruby GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
