Use-after-poison in str_new_frozen_buffer in Ruby
Summary
OSV-2023-322: Use-after-poison in str_new_frozen_buffer. Affects ruby versions >= 19aa30d5d515cd602211d4708e709913d5a136e1, < 628e432739e1d2578d357420aa652a97eb8c2649. Fixed in 628e432739e1d2578d357420aa652a97eb8c2649. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is a dynamic, open-source programming language known for its simplicity and productivity. It is widely used for web development, scripting, and system administration tasks. The vulnerability in question affects the Ruby package and specifically the 'str_new_frozen_buffer' function.
Vulnerability Detail
The vulnerability, identified as OSV-2023-322, is a use-after-poison issue in the 'str_new_frozen_buffer' function of the Ruby package. This vulnerability allows an attacker to read 8 bytes of uninitialized memory, potentially leading to information disclosure or remote code execution. The issue was discovered through an OSS-Fuzz report and has been assigned a severity rating of HIGH.
How To Fix
Minimum fixed version
628e432739e1d2578d357420aa652a97eb8c2649
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
In conclusion, the 'str_new_frozen_buffer' function in the Ruby package is vulnerable to a use-after-poison issue. It is recommended to update to a version of Ruby that includes the fix for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ruby →
FAQ
This vulnerability could potentially allow an attacker to read uninitialized memory, which may lead to the disclosure of sensitive information or the execution of arbitrary code.
The vulnerability was discovered through an OSS-Fuzz report, which identified a use-after-poison issue in the 'str_new_frozen_buffer' function of the Ruby package.
This vulnerability has been assigned a severity rating of HIGH.
Yes, a fix has been implemented in commit '628e432739e1d2578d357420aa652a97eb8c2649' of the Ruby repository. Updating to a version that includes this commit will address the vulnerability.
No specific workarounds have been provided for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
