Heap-buffer-overflow in udiv in mruby
Summary
OSV-2022-672: Heap-buffer-overflow in udiv. Affects mruby versions >= e04184185ab43b94980550e850d8813a415fa438, < 5ccca7e45b802051e00e3398ecf036f86ba92843. Fixed in 5ccca7e45b802051e00e3398ecf036f86ba92843. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embedded in other software and provides a minimalistic and efficient runtime environment. The udiv function in mruby is responsible for performing division operations on arbitrary-precision integers. However, a heap-buffer-overflow vulnerability has been discovered in this function.
Vulnerability Detail
The heap-buffer-overflow vulnerability in udiv can be triggered when performing division operations on certain inputs. This can lead to a write overflow of 4 bytes, potentially causing a crash or enabling an attacker to execute arbitrary code. The vulnerability has been identified and reported through the OSS-Fuzz project.
How To Fix
Minimum fixed version
5ccca7e45b802051e00e3398ecf036f86ba92843
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating mruby to a patched version.
Conclusion
In conclusion, a heap-buffer-overflow vulnerability has been identified in the udiv function of mruby. This vulnerability can potentially lead to crashes or arbitrary code execution. It is recommended to update mruby to a version that includes the fix to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is a lightweight implementation of the Ruby programming language designed for embedding in other software.
The udiv function in mruby is responsible for performing division operations on arbitrary-precision integers.
A heap-buffer-overflow vulnerability occurs when a program writes data beyond the bounds of a dynamically allocated buffer in the heap, potentially leading to crashes or arbitrary code execution.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software.
Yes, a fix for this vulnerability has been implemented in commit 5ccca7e45b802051e00e3398ecf036f86ba92843. Updating mruby to a version that includes this commit or any subsequent version will resolve the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
