mruby Out-of-Bounds Write Vulnerability in Array Extension

A critical out-of-bounds write vulnerability has been identified in mruby version 3.4.0. The issue arises in the function 'ary_fill_exec' within the file 'mrbgems/mruby-array-ext/src/array.c'. The vulnerability is triggered by manipulating the 'start' and 'length' arguments, leading to a buffer underflow and unauthorized memory write. This flaw must be exploited locally, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability causes a buffer underflow, allowing memory to be written out of bounds, which can lead to memory corruption.

Reproduction

The vulnerability can be reproduced by calling the 'Array#__fill_exec' method with a negative start index and a positive length. This can be done in Ruby code that is loaded into mruby. The negative start index causes a pointer underflow, which results in writing data before the beginning of the array, thus creating an out-of-bounds write condition.

Remediation

The vulnerability has been patched in mruby version 3.4.0. Users should update to the latest version to address this issue.