Loading HuntDB...

Null target_class DoS

High
S
shopify-scripts
Submitted None
Reported by h72

Vulnerability Details

Technical details and impact analysis

Uncontrolled Resource Consumption
The `Object#instance_exec` method in `mrbgems/mruby-object-ext/src/object.c` executes a block in the context of an object. It sets the VM's `target_class` pointer to the singleton class of this object. `target_class` is used as the definition target for constants and methods. If a singleton class cannot be created for an object, `target_class` is set to `NULL`. The `OP_CLASS` and `OP_MODULE` opcodes in the VM assume `target_class` is not null when defining new classes and modules. This causes a null pointer dereference and segfaults the mruby VM. Sample code: ``` 1.instance_exec { class X; end } ```

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$8000.00

Submitted

Weakness

Uncontrolled Resource Consumption