Segv on unknown address in mrb_bint_cmp in mruby
Summary
OSV-2022-632: Segv on unknown address in mrb_bint_cmp. Affects mruby versions >= e04184185ab43b94980550e850d8813a415fa438, < 26ce85bd5de515906e01fdeeac774316628ad599. Fixed in 26ce85bd5de515906e01fdeeac774316628ad599. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embedded in other applications and provides a minimalistic and efficient runtime environment. The vulnerability in question affects the mruby package and can lead to a segmentation fault (Segv) when an unknown address is encountered during the mrb_bint_cmp operation.
Vulnerability Detail
The vulnerability arises from a segmentation fault that occurs when an unknown address is encountered in the mrb_bint_cmp function. This can be triggered by certain inputs or conditions, leading to a crash. The impact of this vulnerability can vary depending on the context in which mruby is used. In some cases, it may result in a denial of service (DoS) situation where the application crashes or becomes unresponsive. It is important to note that this vulnerability has been identified and reported through the OSS-Fuzz project.
How To Fix
Minimum fixed version
26ce85bd5de515906e01fdeeac774316628ad599
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At present, there is no known workaround for this vulnerability. It is advised to apply the fix mentioned above by updating the mruby package to a patched version.
Conclusion
In conclusion, the vulnerability in mruby that leads to a segmentation fault on an unknown address in the mrb_bint_cmp function has been identified and addressed. To mitigate this vulnerability, it is recommended to update the mruby package to a version that includes the fix. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is a lightweight implementation of the Ruby programming language designed for embedding in other applications.
The vulnerability can lead to a segmentation fault and potentially result in a denial of service situation.
To fix this vulnerability, update the mruby package to a version that includes the fix.
No, there is currently no known workaround for this vulnerability.
You can find more information about this vulnerability in the OSS-Fuzz report linked in the details section of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
