CVE-2011-0188: Medium severity ruby vulnerability
Drew Yao of Apple Product Security reported a flaw in how Ruby's BigDecimal implementation. In a 64-bit program, if the amount of memory to allocate is greater than 2^32, the allocated amount will be truncated to a 32-bit unsigned integer, however the amount to memset will use the full 64-bit number, leading to a crash or memory corruption. After the memset, the unexpectedly small buffer could be used in other ways that lead to memory corruption or, possibly, code execution.
This flaw only affects 64-bit processes.
To test whether or not ruby is vulnerable, the following can be used (on a vulnerable ruby it will cause a segfault):
$ ruby -e 'require "bigdecimal"; BigDecimal.new("8").(0x20000000)'
Upstream committed the following to fix the flaw:
http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ext/bigdecimal/bigdecimal.c?r1=29364&r2=30993
Other sources
The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0188?
CVE-2011-0188 is considered to have a moderate severity due to the potential memory allocation issues in Ruby's BigDecimal implementation.
How do I fix CVE-2011-0188?
To fix CVE-2011-0188, upgrade Ruby to a version later than 1.9.2-p136 that addresses this vulnerability.
Which versions of Ruby are affected by CVE-2011-0188?
CVE-2011-0188 affects Ruby versions up to and including 1.9.2-p136.
Does CVE-2011-0188 affect macOS?
No, CVE-2011-0188 does not affect macOS versions stated in the vulnerability report.
What kind of issue does CVE-2011-0188 represent?
CVE-2011-0188 represents a memory truncation issue that could potentially lead to unexpected behavior in applications using Ruby.