shopify-scripts: heap-use-after-free /home/operac/testafl/mruby/mrubylast/mruby/src/gc.c

The following code triggers a use-after-free when mruby is compiled with ASAN, on this code path: https://github.com/mruby/mruby/blob/master/src/gc.cL762 POC va0ue0=0,0,0,0 u= h= va0ue0.each do va0ue0.uniq!do va0ue0.zip va0ue0.each do v do% end end end end ASAN output:...

shopify-scripts: Incorrect code generation with redo inside NODE_RESCUE.

The following code causes mruby to use up all available memory: class A redo rescue c end Following the execution, we see the code in codegen.c jumping between CASEOPONERR and CASEOPJMP. CASEOPONERR uses realloc to double the size of mrb-c-rescue, and since it is stuck in an infinite loop between...

shopify-scripts: Crash in print_backtrace

This crash does not affect mruby-engine because it does not print the back trace in guest. We can control the register by setting a backtrace array. PoC ruby exc = Exception.new exc.setbacktrace0x41414141 raise exc GDB $ gdb -q --args ./bin/mruby test12.rb Reading symbols from ./bin/mruby...done...

shopify-scripts: SIGSEGV - mrb_obj_extend - line:413

PoC: ------------------- The following code triggers the bug attached as testmrbobjextend413.rb: module Test end def methodmissingsextendTestend def setva.set0end set0 Mirb - Debug: ------------------- gdb r testmrbobjextend413.rb The program being debugged has been started already. Start it from...

shopify-scripts: SIGSEGV - mrb_vm_exec - line:1681

PoC: ------------------- The following code triggers the bug attached as testmrbvmexec1681.rb: def try yield ensure yield end a=lambda do a.try do return end end.call Mirb - Debug: ------------------- gdb r testmrbvmexec1678.rb The program being debugged has been started already. Start it from th...

shopify-scripts: Heap Buffer overflow in mrb_funcall_with_block

@ssarong discovered a heap buffer overflow vulnerability in MRuby. The issue was reported upstream in https://github.com/mruby/mruby/issues/3398 and fixed in https://github.com/mruby/mruby/commit/a3571240e5fdbdac9210be27e2445e3f82239f44...

shopify-scripts: Segmentation fault on program counter

Mruby running on linux x64 gcc version 4.8.4 Ubuntu 4.8.4-2ubuntu114.04.3 poc for i in methods Kernel.initialize.publicmethods print print %i0 0 0 0end output ----------------------------------registers----------------------------------- RAX: 0x6b0e00 -- 0x80101 RBX: 0x6bef20 -- 0x6b73d0 -- 0x210...

shopify-scripts: Clearing , Shifting and Pop Value from Frozen Array

Hey again! Founded another missing best practice in mruby. That allow an attacker to Delete pop or clear the Frozen ARRAY. This report is similar to 194866 POC === $a = 1,2,3,4,5.freeze $a.pop "= This will give 5 and $a will become 1,2,3,4" $a.shift "= This will give 1 and $a will become 2,3,4,5"...

shopify-scripts: Deleting Key-value pair from Frozen HASH or Clearing a Frozen HASH

Hey! while reviewing mruby for vulnerabilities, I stumble onto a snippet that allow an attacker to delete "key-value Pair" from a "Frozen" Hash or to clear the "Frozen" HASH. Reproduction Step ============= 1. Create a Hash like h = "a" = 100, "b" = 200 2. Freeze this hash 3. Now call delete meth...

shopify-scripts: SIGSEGV - kh_resize_iv - Null Deref

PoC --------------------- The following code triggers the bug attached as khresizeiv.rb: l t'',''doend s'',''do.end d t''do.end a=Array.new a.=102,0 € s a.tos a a.tos a.i Debug - mirb --------------------- gdb r khresizeiv.rb Starting program: /home/x/Desktop/research/mruby/bin/mirb khresizeiv.rb...

shopify-scripts: attempting double-free using the mruby compiler `mrbc`

I cloned the mruby git 4 days ago, started fuzzing with American Fuzzy Lop. This is the 1st crash. ./mrbc test000 codegen error:test000:1: too complex expression ================================================================= ==12142==ERROR: AddressSanitizer: attempting double-free on...

shopify-scripts: SIGSEGV Null Pointer mrb_str_concat()

Sample --------------------- The following code triggers the bug attached as mrbstrconcat.rb: a=String.new a.concata Crash --------------------- x@x:/Desktop/research/mruby-engine/bin$ ./mruby-engine-mirb mirb - Embeddable Interactive Ruby Shell a=String.new a.concata = "" Segmentation fault Debu...

shopify-scripts: heap-buffer-overflow on mruby

Test case: A = 'z' C = 'a','a','a','a','a','a','a','a','a','a' I = C,'a','a','a','a','a','a','a','a','a' J = I,'a','a','a','a','a','a','a','a','a' M = A,A,A,J for a in M do AA end IMPACT ASAN report this as heap-buffer-overflow, and it crashed on 0 memcpysse2unaligned at...

shopify-scripts: Integer Overflow in mrb_ary_set

Hi, I found a crash in mruby. I frankly couldn't reproduce it in mruby-engine. I think it is because of memory limitation, but I'm not sure. Here is a PoC when the size of MRBINT is 32. ruby ary = Array.new0 ary0x7fffffff = 1 $ gdb -q --args ./bin/mruby ./test.rb Reading symbols from...

Ruby: Buffer underflow in sprintf

Hi, So I found this in mruby as part of the shopify-scripts program, and I notice that my patch also landed upstream in ruby as well. Shame on me for not checking ruby as well! Wondered if it counted for a bounty here as well? https://github.com/mruby/mruby/issues/3347 - issue that shopify guys...

shopify-scripts: SIGSEGV on mruby mrb_get_args()

There is invalid memory read on mruby when calling to mrbgetargs with invalid RArray which causes a SIGSEGV to denial of service. The following code triggers the bug attached as mrbgetargs.rb: l...

shopify-scripts: Invalid memory access in `mrb_str_format`

Only affects mruby because mruby-engine doesn't have sprintf. I should have filed this last friday before I went to the pub, so missed out on higher bounties. Oh well! Crash file is: sprintf"%1$c", 0 Crash is: $ lldb ./bin/mruby ../crash.rb lldb target create "./bin/mruby" Current executable set ...

shopify-scripts: Segfault when passing invalid values to `values_at`

Introduction ============ Passing primitive non-Fixnum values to the valuesat method of Struct and Range leads to a segfault in both mruby and mruby-engine/parent Ruby process. Proof of concept ================ list-crash.rb ------------- .valuesat true struct-crash.rb ---------------...

shopify-scripts: Certain inputs cause tight C-level recursion leading to process stack overflow

Introduction ============ Certain legal Ruby programs can cause a tight recursion on the C-level without using eval while spending very little of the Ruby-level stack. This precludes triggering a Ruby stack overflow exception and eventually leads to a process stack overflow and a segfault. Both...

shopify-scripts: Buffer overflow in mrb_time_asctime

Hi, This one doesn't always crash every time, but with ASAN on it will. Crash file is: Time.new-0XD00000000000000&0 But you could always do Time.atsec,usec with special values, and basically anything that gets tos called mrbtimeasctime in C in this case, no method found exception does this. Crash...