Type confusion in mrb_exc_set leading to memory corruption
Critical
S
shopify-scripts
Submitted None
Actions:
Reported by
raydot
Vulnerability Details
Technical details and impact analysis
Similar to #181871, but the bug is more general. The E_*_ERROR macros are not constants, so the exception types can be redefined to not be exceptions:
#define E_NOTIMP_ERROR (mrb_class_get(mrb, "NotImplementedError"))
This means that any code calling mrb_raise on an exception macro can instead get a non-exception object, leading to memory corruption and arbitrary code execution. This snippet causes a native crash in mruby-engine:
NotImplementedError = String
Module.constants # mrb_raise(mrb, E_NOTIMP_ERROR, "Module.constants not implemented");
This should be fixed by making mrb_exc_set check that it is an exception type. Attached is a patch to mruby to fix this problem.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Uncontrolled Resource Consumption