CVE-2018-1000201 (published 2018-06-22T18:29Z)

ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-426
cwe_name: Untrusted Search Path
description: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
extended_description: 
            This might allow attackers to execute their own programs, access unauthorized data files, or modify configuration in unexpected ways. If the product uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted product would then execute. The problem extends to any type of critical resource that the product trusts.
            Some of the most common variants of untrusted search path are:
               
                  In various UNIX and Linux-based systems, the PATH environment variable may be consulted to locate executable programs, and LD_PRELOAD may be used to locate a separate library.
                  In various Microsoft-based systems, the PATH environment variable is consulted to locate a DLL, if the DLL is not found in other paths that appear earlier in the search order.
               
         
         

Fix information:
repo_url: https://github.com/ffi/ffi
commit_details: repo_url: https://github.com/ffi/ffi
author: Lars Kanis
author_date: 2018-06-01 22:18:25+02:00
msg: Don't treat Symbol args different to Strings in ffi_lib

Symbols were sent directly to FFI::DynamicLibrary.open in the first
attempt, resulting in a TypeError, so that only the mangled library
name was actually loaded.

This moves conversion to String to the front, so that subsequent
calls can assume Strings only.
repository: repo_url: https://github.com/ffi/ffi
repo_name: ffi/ffi
description: Ruby FFI
repo_language: Ruby
owner: ffi
file_changes: filename: library.rb
change_type: ModificationType.MODIFY
diff: @@ -43,7 +43,6 @@ module FFI
   #  FFI.map_library_name 'jpeg'  # -> "jpeg.dll"
   def self.map_library_name(lib)
     # Mangle the library name to reflect the native library naming conventions
-    lib = lib.to_s unless lib.kind_of?(String)
     lib = Library::LIBC if lib == 'c'
 
     if lib && File.basename(lib) == lib
@@ -103,7 +102,7 @@ module FFI
           FFI::DynamicLibrary.open(nil, FFI::DynamicLibrary::RTLD_LAZY | FFI::DynamicLibrary::RTLD_LOCAL)
 
         else
-          libnames = (name.is_a?(::Array) ? name : [ name ]).map { |n| [ n, FFI.map_library_name(n) ].uniq }.flatten.compact
+          libnames = (name.is_a?(::Array) ? name : [ name ]).map(&:to_s).map { |n| [ n, FFI.map_library_name(n) ].uniq }.flatten.compact
           lib = nil
           errors = {}
 
@@ -126,7 +125,6 @@ module FFI
                 retry
               else
                 # TODO better library lookup logic
-                libname = libname.to_s
                 unless libname.start_with?("/")
                   path = ['/usr/lib/','/usr/local/lib/'].find do |pth|
                     File.exist?(pth + libname)

programming_language: Ruby
repo_url: https://github.com/ffi/ffi
commit_details: repo_url: https://github.com/ffi/ffi
author: Lars Kanis
author_date: 2018-06-01 22:31:40+02:00
msg: Don't search in hardcoded paths on Windows

Native Windows apps don't use "/usr" path to store system dlls.
It's even more harm than good to search through these directories,
since they are used in Cygwin and it can lead to accidentaly loading
Cygwin DLLs into native Windows apps.

Hardcoded paths are disabled for MINGW and MSWIN environments only.
They are still present on Cygwin and MSYS2, because these POSIX-API
based environments don't use LoadLibrary() but dl_open() to load DLLs.
repository: repo_url: https://github.com/ffi/ffi
repo_name: ffi/ffi
description: Ruby FFI
repo_language: Ruby
owner: ffi
file_changes: filename: library.rb
change_type: ModificationType.MODIFY
diff: @@ -125,7 +125,7 @@ module FFI
                 retry
               else
                 # TODO better library lookup logic
-                unless libname.start_with?("/")
+                unless libname.start_with?("/") || FFI::Platform.windows?
                   path = ['/usr/lib/','/usr/local/lib/'].find do |pth|
                     File.exist?(pth + libname)
                   end

programming_language: Ruby