Type confusion in mrb_exc_set leading to memory corruption

Disclosed: 2016-12-16 20:26:40 By raydot To shopify-scripts
Critical
Vulnerability Details
Similar to #181871, but the bug is more general. The E_*_ERROR macros are not constants, so the exception types can be redefined to not be exceptions: #define E_NOTIMP_ERROR (mrb_class_get(mrb, "NotImplementedError")) This means that any code calling mrb_raise on an exception macro can instead get a non-exception object, leading to memory corruption and arbitrary code execution. This snippet causes a native crash in mruby-engine: NotImplementedError = String Module.constants # mrb_raise(mrb, E_NOTIMP_ERROR, "Module.constants not implemented"); This should be fixed by making mrb_exc_set check that it is an exception type. Attached is a patch to mruby to fix this problem.
Actions
View on HackerOne
Report Stats
  • Report ID: 185041
  • State: Closed
  • Substate: resolved
  • Upvotes: 40
Share this report