CVE-2022-28738: Double Free
A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations.
Other sources
A double-free vulnerability was found in Ruby. The issue occurs during Regexp compilation. This flaw allows an attacker to create a Regexp object with a crafted source string that could cause the same memory to be freed twice.
VE-2022-28738: Double free in Regexp compilation
Posted by mame on 12 Apr 2022
A double-free vulnerability is discovered in Regexp compilation. This vulnerability has been assigned the CVE identifier CVE-2022-28738. We strongly recommend upgrading Ruby. Details
Due to a bug in the Regexp compilation process, creating a Regexp object with a crafted source string could cause the same memory to be freed twice. This is known as a “double free” vulnerability. Note that, in general, it is considered unsafe to create and use a Regexp object generated from untrusted input. In this case, however, following a comprehensive assessment, we treat this issue as a vulnerability.
Please update Ruby to 3.0.4, or 3.1.2. Affected versions
ruby 3.0.3 or prior ruby 3.1.1 or prior
Note that ruby 2.6 series and 2.7 series are not affected. Credits
Thanks to piao for discovering this issue. History
Originally published at 2022-04-12 12:00:00 (UTC)
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-28738?
CVE-2022-28738 is a double-free vulnerability found in Ruby, specifically in the Regexp compiler.
How does CVE-2022-28738 affect Ruby?
CVE-2022-28738 allows an attacker to write to unexpected memory locations if a victim attempts to create a Regexp from untrusted user input.
Which versions of Ruby are affected by CVE-2022-28738?
Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2 are affected by CVE-2022-28738.
What is the severity of CVE-2022-28738?
CVE-2022-28738 has a severity value of 9.8, which is considered critical.
How do I fix CVE-2022-28738?
To fix CVE-2022-28738, update Ruby to version 3.0.4 or 3.1.2, depending on the affected version.