Internet Bug Bounty · Report #1549636
CVE-2022-28738: Double free in Regexp compilation
Summary
A double-free vulnerability is discovered in Regexp compilation. This vulnerability has been assigned the CVE identifier CVE-2022-28738. We strongly recommend upgrading Ruby.
Details Due to a bug in the Regexp compilation process, creating a Regexp object with a crafted source string could cause the same memory to be freed twice. This is known as a “double free” vulnerability. Note that, in general, it is considered unsafe to create and use a Regexp object generated from untrusted input. In this case, however, following a comprehensive assessment, we treat this issue as a vulnerability.
Please update Ruby to 3.0.4, or 3.1.2.
Affected versions ruby 3.0.3 or prior ruby 3.1.1 or prior Note that ruby 2.6 series and 2.7 series are not affected.
Credits Thanks to piao for discovering this issue.
History Originally published at 2022-04-12 12:00:00 (UTC)
https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/
How it was found
Due to a bug in the Regexp compilation process, creating a Regexp object with a crafted source string could cause the same memory to be freed twice. This is known as a “double free” vulnerability. Note that, in general, it is considered unsafe to create and use a Regexp object generated from untrusted input. In this case, however, following a comprehensive assessment, we treat this issue as a vulnerability.
poc:
ruby -e '/(\\x15\\x17\\xE2\\xF5\\xF5\\xF5\\xC2\\x04\\x08J,\\x00\\xD0\\x00\\x00(?(1)\\xF5\\xF5\\xF5\\xD7\\xF5\\xF5\\xF5\\x87\\x04\\xFA555\\xBEJ,\\x18FF\\x15\\xFF|\\x03\\x01\\x00\\x01\\x00\\x00\\x8F\r|)44\\x00\\x8F\r|)+/m'
Impact
may lead to a RCE attack cooperate with marshal.load