Ruby: sprintf combined format string attack

In a ticket that was also reported to "shopify-scripts" regarding "MRuby", I reported in details a combined attack against the sprintf gem: Information leak Heap buffer underflow The full ticket details can be found in: Ticket 212239 The ticked was opened several minutes ago but I add it in case ...

shopify-scripts: Null pointer dereference in mrb_class

The following code demonstrates a segfault in mruby and mruby-engine: module A module A ensure module A module A module A module A ensure module A module A module A module A module A module A a ensure module A yield end end end end end end end end end end end end end The mruby crash is due to a...

shopify-scripts: Null pointer dereference in 'get_file'

@ssarong reported a null pointer dereference in MRuby: https://github.com/mruby/mruby/issues/3492 This issue was fixed in the following commits: https://github.com/mruby/mruby/commit/dcf6a413cab097e39d2d883d7c8c297d29ea43b8...

shopify-scripts: Null pointer dereferences from mrb_vm_exec

@ssarong reported a null pointer dereference in MRuby: https://github.com/mruby/mruby/issues/3491 The issue was fixed in the following commits: https://github.com/mruby/mruby/commit/b8461c86817fd2f766746e61e9f93362955a3474...

shopify-scripts: Invalid Pointer Reference from OP_RESCUE

@ssarong reported a null pointer dereference in MRuby: https://github.com/mruby/mruby/issues/3518 This issue was fixed in https://github.com/mruby/mruby/commit/75c374cad330e2c99ceb7e1ca083523a7651e753...

shopify-scripts: Heap buffer overflow in mruby value_move

Hi: The following program demonstrates heap overflow on current up-to-date master branch mruby at the time of report, Latest commit 8b089c0 Program lead to crash is d 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0...

shopify-scripts: Null pointer dereference in mark_context_stack

The following code causes a segfault in mruby and mruby-engine: class A rescue "" end end mruby crashes due to a null pointer dereference in markcontextstack gc.c:554: 553│ if !mrbimmediatepv 554├ if mrbbasicptrv-tt == MRBTTFREE 555│ c-stbasei = mrbnilvalue; gdb print v $1 = value = f = 0, p = 0x...

shopify-scripts: Memory corrouption in mrb_gc_mark

The memory corruption in mrbgcmark function can lead to code execution or at least DoS on mruby. PoC attached. Crash debug mr@minhrau $ ./mrubylatest/mruby/build/bench/bin/mruby ./mruby/fuzz03/crashes/mrbgcmark.rb Reading symbols from ./mrubylatest/mruby/build/bench/bin/mruby...done. gdb r...

shopify-scripts: Heap Buffer Overflow while processing OP_SEND

@ssarong reported a heap buffer overflow in MRuby: https://github.com/mruby/mruby/issues/3475 This issue was fixed in https://github.com/mruby/mruby/commit/8b089c09f7ddaa513d14c84a04e050abc17b01b3...

shopify-scripts: mruby heap use-after-free

By doing some fuzzing against mruby, I spot this vulnerability, The source code should be compiled with AddressSanitizer, Here is the vulnerable code : class NoMethodError NameError def initializemessage=nil, name=nil, args=nil @args = ar super message,&name end end class StopIteration r :result...

shopify-scripts: Use After Free in mrb_vm_exec

@ssarong reported the following crash in MRuby: https://github.com/mruby/mruby/issues/3465 The issue was patched in https://github.com/mruby/mruby/commit/9e93d5dbf0c96cbf5cc0bc5a9c5f734248d7c37b...

shopify-scripts: Heap Buffer overflow in mrb_ary_unshift

@ssarong reported the following crash in MRuby: https://github.com/mruby/mruby/issues/3464 This issue was patched in https://github.com/mruby/mruby/commit/50bbdbb11b1cecd2843db2825cab4081893047c1...

shopify-scripts: A crash when an exception is caught in a caller and the receiver returned from `ensure`

This snippet crashes when ran by ./bin/sandbox: ruby class A def foo pr = proc return 1 begin doesnotexist ensure pr end end end begin A.new.foo rescue end Crash details: ./bin/sandbox:20: BUG Segmentation fault at 0x0000000000000e ruby 2.3.1p112 2016-04-26 revision 54768 x8664-linux -- Control...

shopify-scripts: segafult in mruby's sprintf - mrb_str_format

The mruby sprintf gem out of scope of mruby-engine can be crashed when using a hostile "width" value in the format string. Exploit Script =========== ruby s = "hello" sprintf"abcdefghijklmnopqrstuvwxyz % 2147483640s", s Here is the core dump: Core was generated by...

shopify-scripts: Denial of service (segfault) due to null pointer dereference in mrb_vm_exec

Introduction ============ Provided PoC segfaults at mrbvmexec due to null pointer dereference. Proof of concept ================ Attached the poc. Crash report ============ ./sandbox vmexec.rb ./sandbox:20: BUG Segmentation fault at 0x00000000000000 ruby 2.3.1p112 2016-04-26 x8664-linux-gnu --...

shopify-scripts: Denial of service (segfault) due to null pointer dereference in mrb_obj_instance_eval

Introduction ============ Provided PoC segfaults at mrbobjinstanceeval due to null pointer dereference. Proof of concept ================ Attached the poc. Crash report ============ ./sandbox eval.rb ./sandbox:20: BUG Segmentation fault at 0x00000000000003 ruby 2.3.1p112 2016-04-26 x8664-linux-gn...

shopify-scripts: SIGSEGV - vm.c - line:1214

PoC ------------------- The following code triggers the bug attached as testmrbvmexec1214.rb: def test instanceexec do return toenum:==end ensure end test Debug - mirb ------------------- gdb r testmrbvmexec1214.rb Starting program: /home/x/Desktop/research/3fuzz/mruby/bin/mirb testmrbvmexec1214....

shopify-scripts: Segmentfault at mrb_vm_exec

@ssarong discovered an integer overflow in MRuby's code generator, which resulted in a crash. The issue was reported upstream in https://github.com/mruby/mruby/issues/3426 and fixed in https://github.com/mruby/mruby/commit/6e0ba0085d22b7751c46b178e841046483f0f6b4...

shopify-scripts: heap-use-after-free /home/operac/testafl/mruby/mrubylast/mruby/src/gc.c

The following code triggers a use-after-free when mruby is compiled with ASAN, on this code path: https://github.com/mruby/mruby/blob/master/src/gc.cL762 POC va0ue0=0,0,0,0 u= h= va0ue0.each do va0ue0.uniq!do va0ue0.zip va0ue0.each do v do% end end end end ASAN output:...

shopify-scripts: Incorrect code generation with redo inside NODE_RESCUE.

The following code causes mruby to use up all available memory: class A redo rescue c end Following the execution, we see the code in codegen.c jumping between CASEOPONERR and CASEOPJMP. CASEOPONERR uses realloc to double the size of mrb-c-rescue, and since it is stuck in an infinite loop between...