Index-out-of-bounds in str_init_embed in mruby
Summary
OSV-2022-1160: Index-out-of-bounds in str_init_embed. Affects mruby versions >= 4e9773ae3db701ff284171f916d3cd144d6fcae4, < 6bcbfed8bb955a4412e0ca79da0244f97076ba18. Fixed in 6bcbfed8bb955a4412e0ca79da0244f97076ba18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embedded in other applications and provides a minimalistic and efficient runtime environment. The str_init_embed function in mruby is responsible for initializing embedded strings. This vulnerability affects versions 4e9773ae3db701ff284171f916d3cd144d6fcae4 to 6bcbfed8bb955a4412e0ca79da0244f97076ba18 of mruby.
Vulnerability Detail
The vulnerability is an index-out-of-bounds issue that occurs in the str_init_embed function of mruby. This vulnerability can be triggered when initializing embedded strings, leading to a crash. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. The vulnerability was reported through the OSS-Fuzz project, and more details can be found in the provided link.
How To Fix
Minimum fixed version
6bcbfed8bb955a4412e0ca79da0244f97076ba18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned above.
Conclusion
In conclusion, the index-out-of-bounds vulnerability in the str_init_embed function of mruby can be fixed by updating to version 6bcbfed8bb955a4412e0ca79da0244f97076ba18 or later. It is important to stay up-to-date with the latest security patches to ensure the security of your application. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is an open-source lightweight implementation of the Ruby programming language that is designed to be embedded in other applications.
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition.
This vulnerability was discovered through the OSS-Fuzz project, which is a continuous fuzzing service for open-source software.
There is no known workaround for this vulnerability. It is recommended to apply the provided fix.
To ensure the security of your application, it is recommended to always use the latest stable version of mruby and regularly update it to include the latest security patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
