CVE-2022-1201

2022-04-0208:15:06

Debian Security Bug Tracker

security-tracker.debian.org

github

vulnerability

mruby

interpreter

crash

system availability

unix

CVSS2

4.9

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS3

6.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

EPSS

Percentile

12.8%

JSON

NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is capable of making the mruby interpreter crash, thus affecting the availability of the system.

OSVersionArchitecturePackageVersionFilename
Debian12allmruby< 3.1.0-1mruby_3.1.0-1_all.deb
Debian11allmruby<= 2.1.2-3mruby_2.1.2-3_all.deb
Debian999allmruby< 3.1.0-1mruby_3.1.0-1_all.deb
Debian13allmruby< 3.1.0-1mruby_3.1.0-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	mruby	< 3.1.0-1	mruby_3.1.0-1_all.deb
Debian	11	all	mruby	<= 2.1.2-3	mruby_2.1.2-3_all.deb
Debian	999	all	mruby	< 3.1.0-1	mruby_3.1.0-1_all.deb
Debian	13	all	mruby	< 3.1.0-1	mruby_3.1.0-1_all.deb