Heap-buffer-overflow in pack_unpack in mruby
Summary
OSV-2023-937: Heap-buffer-overflow in pack_unpack. Affects mruby versions >= e7021f190a5527b497163d3b7093bcc56fecdde0, < 097681b4d458899dff945138ea39ae125df3e16a. Fixed in 097681b4d458899dff945138ea39ae125df3e16a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mruby is an open-source lightweight implementation of the Ruby programming language. It is designed to be embedded in other applications and provides a minimalistic and efficient runtime environment. The pack_unpack function in mruby is responsible for packing and unpacking data. However, a vulnerability has been discovered in this function that can lead to a heap-buffer-overflow read.
Vulnerability Detail
The vulnerability in pack_unpack function allows an attacker to read beyond the bounds of a heap buffer. This can result in the disclosure of sensitive information or the execution of arbitrary code. The vulnerability can be triggered by providing specially crafted input to the function. The issue was reported through the OSS-Fuzz project and has been assigned a medium severity level.
How To Fix
Minimum fixed version
097681b4d458899dff945138ea39ae125df3e16a
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, a heap-buffer-overflow vulnerability has been discovered in the pack_unpack function of the mruby package. Users are advised to update their mruby installation to a version that includes the fix for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mruby →
FAQ
mruby is a lightweight implementation of the Ruby programming language designed for embedding in other applications.
The pack_unpack function in mruby is responsible for packing and unpacking data.
A heap-buffer-overflow occurs when a program tries to read or write data beyond the bounds of a heap-allocated buffer.
This vulnerability can be exploited by providing specially crafted input to the pack_unpack function, triggering a heap-buffer-overflow read.
This vulnerability has been assigned a medium severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for mruby.
