Heap-use-after-free vulnerability in mruby
Summary
OSV-2023-118: Heap-use-after-free in mrb_gc_mark. Affects mruby versions >= 0a1fd07910f534f0585fa74f9abde261ca6786eb, < 321cfe97605de8f050ac9be597069e370d5d9da3. Fixed in 321cfe97605de8f050ac9be597069e370d5d9da3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embedded in other applications and provides a minimalistic and efficient runtime environment. The vulnerability in question is a heap-use-after-free issue that has been identified in the mruby codebase.
Vulnerability Detail
The vulnerability arises due to a heap-use-after-free condition in the mrb_gc_mark function. This can lead to a crash when attempting to read from freed memory. The issue has been reported through OSS-Fuzz, and the crash state indicates that the problem occurs during garbage collection marking. The severity of this vulnerability is classified as HIGH.
How To Fix
Minimum fixed version
321cfe97605de8f050ac9be597069e370d5d9da3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At present, there is no known workaround for this vulnerability. It is essential to update to a fixed version of the mruby package to mitigate the risk.
Conclusion
In conclusion, the mruby package is affected by a heap-use-after-free vulnerability in the mrb_gc_mark function. This vulnerability can lead to crashes and potentially allow for arbitrary code execution. It is crucial to update to a fixed version of the mruby package to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is a lightweight implementation of the Ruby programming language that is designed to be embedded in other applications.
A heap-use-after-free vulnerability occurs when a program attempts to access memory that has already been freed. This can lead to crashes or potentially allow an attacker to execute arbitrary code.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software.
The severity of this vulnerability is classified as HIGH.
No, there is currently no known workaround for this vulnerability. It is recommended to update to a fixed version of the mruby package.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
