How it was found

Hey!

while reviewing mruby for vulnerabilities, I stumble onto a snippet that allow an attacker to delete "key-value Pair" from a "Frozen" Hash or to clear the "Frozen" HASH.

Reproduction Step

1.) Create a Hash like h = { "a" => 100, "b" => 200 } 2.) Freeze this hash 3.) Now call delete method with "KEY" (the case if you don't know the KEY then you can call .keys method to obtaine all available KEYS in the HASH) ( or call .clear method to clear the HASH )

POC

h = { "a" => 100, "b" => 200 } h.freeze h.delete("a") @output = h

Look at h you will get remaining values after deletion even if the HASH has been frozen. ( in case of h.clear you will get empty HASH ).

Explanation

Bug is happened because there is no method calling to check weather the HASH is frozen or not in both methods mrb_hash_delete hash.c#552 and mrb_hash_clear hash.c#619 in https://github.com/mruby/mruby/blob/master/src/hash.c

This bug may come handy to delete details to cause data corruption.

Fix

Just apply mrb_hash_modify(mrb, self); & mrb_hash_modify(mrb, hash); on line 555 and on line 622 respectively.