Segv on unknown address in mrb_bint_cmp in mruby
Summary
OSV-2022-637: Segv on unknown address in mrb_bint_cmp. Affects mruby versions >= e04184185ab43b94980550e850d8813a415fa438, < 26ce85bd5de515906e01fdeeac774316628ad599. Fixed in 26ce85bd5de515906e01fdeeac774316628ad599. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embedded in other applications and provides a minimalistic and efficient runtime environment. The vulnerability in question, identified as OSV-2022-637, affects mruby and can lead to a segmentation fault (segv) when an unknown address is encountered during the mrb_bint_cmp function execution.
Vulnerability Detail
The vulnerability arises due to a segv on an unknown address within the mrb_bint_cmp function. This can occur during the comparison of binary integers (bints) in the num_cmp function. The exact cause of the segv is not specified in the provided information. However, it is crucial to note that this vulnerability can potentially result in a crash or instability of applications utilizing mruby. Further technical details can be found in the OSS-Fuzz report linked in the vulnerability details.
How To Fix
Minimum fixed version
26ce85bd5de515906e01fdeeac774316628ad599
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround is mentioned in the provided information. However, it is advisable to follow the recommended fix and update the mruby package to a patched version.
Conclusion
In conclusion, the vulnerability OSV-2022-637 in mruby can result in a segv on an unknown address during the mrb_bint_cmp function execution. It is crucial to update the mruby package to a version containing the fix to mitigate the risk of crashes or instability in applications utilizing mruby. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is an open-source lightweight implementation of the Ruby programming language, designed to be embedded in other applications.
The vulnerability can lead to a segmentation fault (segv) when an unknown address is encountered during the mrb_bint_cmp function execution. This can result in crashes or instability of applications utilizing mruby.
To fix this vulnerability, update the mruby package to a version that includes the fix. The vulnerability was addressed in commit 26ce85bd5de515906e01fdeeac774316628ad599 on the official mruby GitHub repository.
No specific workaround is mentioned in the provided information. It is recommended to update the mruby package to a patched version.
More technical details can be found in the OSS-Fuzz report linked in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
