Segv on unknown address in urshift in mruby
Summary
OSV-2022-622: Segv on unknown address in urshift. Affects mruby versions >= e04184185ab43b94980550e850d8813a415fa438, < 25a32ed681cd3fc48eabd6b8efa5683b1d32ffd0. Fixed in 25a32ed681cd3fc48eabd6b8efa5683b1d32ffd0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embedded in other software and provides a minimalistic and efficient runtime environment. The vulnerability in mruby allows for a segmentation fault (Segv) on an unknown address during the urshift operation. This vulnerability was reported through the OSS-Fuzz project.
Vulnerability Detail
The vulnerability occurs in the urshift operation of mruby, leading to a segmentation fault. The crash state indicates that the crash happens in the mpz_div_2exp function, which is called by mrb_bint_rshift. The exact cause of the crash is not specified in the provided information. However, it is important to note that a segmentation fault can potentially lead to a denial of service (DoS) attack or even remote code execution if exploited correctly.
How To Fix
Minimum fixed version
25a32ed681cd3fc48eabd6b8efa5683b1d32ffd0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround is mentioned in the provided information. It is advised to follow the recommended fix and update the package to a patched version.
Conclusion
The vulnerability in mruby, which causes a segmentation fault during the urshift operation, can have serious consequences if exploited. It is crucial to update the package to a version that includes the fix to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is a lightweight implementation of the Ruby programming language designed for embedding in other software.
The vulnerability can lead to a segmentation fault, potentially resulting in a denial of service (DoS) attack or remote code execution.
This vulnerability was reported through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software.
Yes, a fix for this vulnerability is available. It is recommended to update the mruby package to a version that includes the fix.
No specific workarounds are mentioned in the provided information. It is advised to update the package to a patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
