Critical Double Free Vulnerability in Ruby 3.0 - CVE-2022-28738
Summary
UBUNTU-CVE-2022-28738: A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. Affects ruby3.0 versions < 3.0.2-7ubuntu2.1. Fixed in 3.0.2-7ubuntu2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is a dynamic, open-source programming language with a focus on simplicity and productivity. It has an elegant syntax that is natural to read and easy to write. Ruby 3.0, specifically, is a major release that includes numerous performance improvements and new features. However, it is susceptible to a critical vulnerability that affects its Regexp compiler, which can lead to severe security risks if exploited.
Vulnerability Detail
A double free vulnerability was identified in the Regexp compiler of Ruby versions 3.x prior to 3.0.4 and 3.1.x prior to 3.1.2. This flaw allows an attacker to exploit the Regexp functionality when processing untrusted user input, potentially leading to arbitrary memory writes. The implications of this vulnerability are severe, as it could allow an attacker to manipulate the memory of the application, leading to crashes or execution of arbitrary code.
How To Fix
Minimum fixed version
3.0.2-7ubuntu2.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ruby3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, developers should avoid processing untrusted user input with the Regexp functionality until the package is updated. Implementing input validation and sanitization can also help mitigate the risk of exploitation.
Conclusion
CVE-2022-28738 represents a significant security risk for applications using Ruby 3.0 due to a critical double free vulnerability in the Regexp compiler. It is crucial for developers to update to the patched version to mitigate potential exploitation risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ruby3.0 →
FAQ
CVE-2022-28738 is a critical vulnerability in Ruby 3.0 that allows for double free memory corruption, potentially leading to arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2022-28738 is 9.8, indicating a critical level of severity.
If immediate updates are not feasible, ensure that untrusted user input is not processed with Regexp and implement input validation to reduce risk.
You can find more information about Ruby vulnerabilities and security notices on the official Ruby website and security advisories.
Related vulnerabilities
Recent vulnerabilities recorded for ruby3.0.
