CVE-2024-27280: Buffer Overflow

Published Mar 21, 2024
·
Updated

A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however, for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is stringio 3.0.1.2.

Other sources

AirPort. A permissions issue was addressed with additional restrictions.

— Apple

AMD. A buffer overflow was addressed with improved bounds checking.

— Apple

An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4.

The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value.

This vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x and later.

We recommend to update the StringIO gem to version 3.0.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:

For Ruby 3.0 users: Update to stringio 3.0.1.1 For Ruby 3.1 users: Update to stringio 3.1.0.2

You can use gem update stringio to update it. If you are using bundler, please add gem "stringio", ">= 3.0.1.2" to your Gemfile.

— GitHub

An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4.

The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value.

This vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x and later.

— Red Hat

AppKit. The issue was resolved by blocking unsigned services from launching on Intel Macs.

— Apple

Credit

Rodolphe BRUNETTI@@eisw0lf(Lupus Nova), Csaba Fitzl@@theevilbit(Kandji), Kirin@@Pwnrin, ABC Research s.r.o., Mickey Jin@@patch1t, an anonymous researcher, Nolan Astrein(Kandji), Mickey Jin@@patch1t(Cisco Talos), Kirin@@Pwnrin(Cisco Talos), Claudio Bozzato(Cisco Talos), Francesco Benvenuto(Cisco Talos), Zhongquan Li@@Guluisacat, Bilal Siddiqui, Hossein Lotfi@@hosselot(Trend Micro Zero Day Initiative), Michael Reeves@@IntegralPilot, Noah Gregory (wts.dev), Dawuge(Shuffle Team), Rosyna Keller(Totally Not Malicious Software), Guilherme Rambo(Best Buddy Apps), Yinyi Wu@@_3ndy1(Dawn Security Lab of JD), @@zlluny(Trend Micro Zero Day Initiative), 이동하 (Lee Dong Ha)(SSA Lab), Zhongcheng Li(IES Red Team of ByteDance), Matej Moravec@@MacejkoMoravec, Shantanu Thakur, Wang Yu(Cyberserval), Anonymous(Trend Micro Zero Day Initiative), Jian Lee@@speedyfriend433, Yiğit Can YILMAZ@@yilmazcanyigit, Keisuke Hosoda, Ye Zhang@@VAR10CK(Baidu Security), Viktor Oreshkin, Nathaniel Oh@@calysteon, Gergely Kalman@@gergely_kalman, Hikerell (Loadshine Lab), Rodolphe Brunetti@@eisw0lf(Lupus Nova), LFY@@secsys(Fudan University), CVE-2025-40909, @@zlluny, CVE-2024-27280, KPC(Cisco Talos), @@RenwaX23, Ye Zhang(Baidu Security), pattern-f@@pattern_F_, 정답이 아닌 해답, Kirin@@Pwnrin(Computer Science), Cristian Dinca(Computer Science), Romania, CVE-2025-6965, JZ, Seo Hyun-gyu@@wh1te4ever, Luke Roberts@@rookuu, Ferdous Saljooki@@malwarezoo(Jamf), Justin Elliot Fu, Pyrophoria(GrapheneOS), an anonymous researcher(GrapheneOS), James J Kalafus, Michel Migdal, ken super, Jaydev Ahire, Big Bear, Ignacio Sanmillan@@ulexec, Mike Cardwell(grepular), Bob Lord, Pawel Wylecial(REDTEAM), @@zlluny(Trend Zero Day Initiative), Duy Trần@@khanhduytran0, @@EthanArbuckle, Wojciech Regula(SecuRing), Google's Threat Analysis Group, Minghao Lin@@Y1nKoc, 风 (binaryfmyy), BochengXiang@@Crispr, YingQi Shi@@Mas0nShi, Dora Orak, Mickey Jin@@patch1t(Fudan University), Kirin@@Pwnrin(Fudan University)

Affected Software

16 affected componentsFixes available
rubygems/stringio<3.0.1.1
3.0.1.1
redhat/stringio<3.0.1.1
3.0.1.1
Apple macOS Tahoe<26
26
Apple macOS Sequoia<15.7
15.7
Apple macOS Sonoma<14.8
14.8
alpine/ruby<3.1.5-r0
3.1.5-r0
alpine/ruby<3.1.5-r0
3.1.5-r0
alpine/ruby<3.2.4-r0
3.2.4-r0
alpine/ruby<3.2.4-r0
3.2.4-r0
alpine/ruby<3.3.1-r0
3.3.1-r0
alpine/ruby<3.3.1-r0
3.3.1-r0
alpine/ruby<3.3.1-r0
3.3.1-r0
alpine/ruby<3.3.1-r0
3.3.1-r0
alpine/ruby<3.3.1-r0
3.3.1-r0
debian/ruby3.1<3.1.2-7+deb12u1
3.1.2-7+deb12u1
debian/ruby3.1
3.1.2-7+deb12u1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade rubygems/stringio to a version that resolves this vulnerability.

    Fixed in 3.0.1.1
  2. Upgrade

    Upgrade redhat/stringio to a version that resolves this vulnerability.

    Fixed in 3.0.1.1
  3. Upgrade

    Upgrade redhat/stringio to a version that resolves this vulnerability.

    Fixed in 3.0.1.2
  4. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 26
  5. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 15.7
  6. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 14.8
  7. Upgrade

    Upgrade alpine/ruby to a version that resolves this vulnerability.

    Fixed in 3.1.5-r0
  8. Upgrade

    Upgrade alpine/ruby to a version that resolves this vulnerability.

    Fixed in 3.2.4-r0
  9. Upgrade

    Upgrade alpine/ruby to a version that resolves this vulnerability.

    Fixed in 3.3.1-r0
  10. Upgrade

    Upgrade debian/ruby3.1 to a version that resolves this vulnerability.

    Fixed in 3.1.2-7+deb12u1
  11. Upgrade

    Upgrade stringio to a version that resolves this vulnerability.

    Fixed in 3.0.3
  12. Configuration

    Add gem "stringio", ">= 3.0.1.2" to the Gemfile when using Bundler.

    Bundler Gemfile dependency = gem "stringio", ">= 3.0.1.2"

Event History

Mar 21, 2024
Data Sourced
via Red Hat·05:49 PM
DescriptionSeverityAffected Software
Mar 25, 2024
Advisory Published
via GitHub·07:36 PM
May 8, 2024
CVE Published
via MITRE·08:51 PM
Data Sourced
via MITRE·08:51 PM
Description
May 14, 2024
Data Sourced
via NVD·03:11 PM
DescriptionSeverityWeakness
Data Sourced
via OSV·03:11 PM
DescriptionSeverityAffected Software
Sep 15, 2025
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2024-27280?

CVE-2024-27280 is classified as a buffer overread vulnerability that can lead to potentially sensitive information disclosure.

2

How do I fix CVE-2024-27280?

To fix CVE-2024-27280, upgrade the StringIO library to version 3.0.1.1 or higher.

3

What versions are affected by CVE-2024-27280?

CVE-2024-27280 affects StringIO versions 3.0.1 through 3.0.6 and 3.1.x through 3.1.4.

4

What are the potential impacts of CVE-2024-27280?

The potential impacts of CVE-2024-27280 include reading past the end of a string, which may leak memory contents.

5

Which packages are affected by CVE-2024-27280?

CVE-2024-27280 affects the StringIO package available through RubyGems and Red Hat.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203