Heap-use-after-free vulnerability in mruby
Summary
OSV-2023-280: Heap-use-after-free in mrb_str_hash_m. Affects mruby versions >= 2de602b8696bc21e4cbc2c6e08e2fae27b1ad79b, < 93648fc954c0133acc6e89860ba49f78ca60460f. Fixed in 93648fc954c0133acc6e89860ba49f78ca60460f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embedded in other applications and provides a minimalistic and efficient runtime environment. The vulnerability in question is a heap-use-after-free issue that has been identified in the mruby codebase.
Vulnerability Detail
The vulnerability arises due to a heap-use-after-free condition in the mrb_str_hash_m function. This function is responsible for calculating the hash value of a string object in mruby. By exploiting this vulnerability, an attacker could potentially execute arbitrary code or cause a denial-of-service condition. The vulnerability was discovered through the OSS-Fuzz project, and more details can be found in the provided link.
How To Fix
Minimum fixed version
93648fc954c0133acc6e89860ba49f78ca60460f
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At the moment, there is no known workaround for this vulnerability. It is crucial to update to a fixed version of the mruby package to mitigate the risk.
Conclusion
In conclusion, the mruby package is affected by a heap-use-after-free vulnerability in the mrb_str_hash_m function. This vulnerability could potentially lead to code execution or denial-of-service. To mitigate the risk, it is crucial to update to a fixed version of the mruby package. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is a lightweight implementation of the Ruby programming language designed for embedding in other applications.
A heap-use-after-free vulnerability occurs when a program attempts to access memory that has already been freed. This can lead to crashes, memory corruption, and potentially, code execution.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software.
Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause a denial-of-service condition.
No, currently there is no known workaround for this vulnerability. It is recommended to update to a fixed version of the mruby package.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
