Loading HuntDB...

Type confusion in mrb_exc_set leading to memory corruption

Critical
S
shopify-scripts
Submitted None
Reported by raydot

Vulnerability Details

Technical details and impact analysis

Uncontrolled Resource Consumption
Similar to #181871, but the bug is more general. The E_*_ERROR macros are not constants, so the exception types can be redefined to not be exceptions: #define E_NOTIMP_ERROR (mrb_class_get(mrb, "NotImplementedError")) This means that any code calling mrb_raise on an exception macro can instead get a non-exception object, leading to memory corruption and arbitrary code execution. This snippet causes a native crash in mruby-engine: NotImplementedError = String Module.constants # mrb_raise(mrb, E_NOTIMP_ERROR, "Module.constants not implemented"); This should be fixed by making mrb_exc_set check that it is an exception type. Attached is a patch to mruby to fix this problem.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Uncontrolled Resource Consumption