DoS: type confusion in mrb_no_method_error
Critical
S
shopify-scripts
Submitted None
Actions:
Reported by
raydot
Vulnerability Details
Technical details and impact analysis
Overwriting the 'new' method of the NoMethodError singleton to not return an exception object leads to memory corruption and possibly arbitrary code execution.
Running the following code under the mruny-engine sandbox script results in a native crash:
NoMethodError.define_singleton_method(:new) do "waat" end
Object.q
Attached is a patch to mitigate the issue.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Uncontrolled Resource Consumption