Heap-buffer-overflow in udiv in mruby
Summary
OSV-2022-679: Heap-buffer-overflow in udiv. Affects mruby versions >= e04184185ab43b94980550e850d8813a415fa438. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embedded in other applications and provides a minimalistic and efficient runtime environment. The vulnerability in mruby is a heap-buffer-overflow issue that can lead to a crash. This vulnerability was reported through the OSS-Fuzz project.
Vulnerability Detail
The vulnerability in mruby is a heap-buffer-overflow WRITE 4 issue. It occurs in the udiv function and can be triggered when performing a modulus operation. The specific crash state involves mrb_bint_mod and int_mod. The severity of this vulnerability is classified as HIGH. Exploiting this vulnerability could lead to arbitrary code execution or denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the fix by updating the mruby package.
Conclusion
The heap-buffer-overflow vulnerability in mruby can lead to crashes and potentially arbitrary code execution or denial of service. It is crucial to update the mruby package to a version that includes the fix. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is a lightweight implementation of the Ruby programming language designed for embedding in other applications.
A heap-buffer-overflow is a type of memory vulnerability where data is written outside the bounds of a allocated buffer in the heap.
Exploiting this vulnerability could lead to arbitrary code execution or denial of service by triggering a crash in the udiv function.
No, there is no known workaround for this vulnerability. Updating the mruby package is necessary.
More information about this vulnerability can be found in the OSS-Fuzz report linked in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
