Miggo Logo
Miggo Vulnerability Database
→
CVE-2017-15364

CVE-2017-15364: ccsv Double Free vulnerability

5.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2017-15364
GHSA ID
GHSA-5gxp-c379-pj42
EPSS Score
0.66911%
CWE
CWE-415
Published
5/17/2022
Updated
3/6/2023
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
ccsvrubygems<= 1.1.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

  1. Multiple sources (CVE, GHSA, ruby-advisory-db) explicitly identify the foreach function in ext/ccsv.c as the vulnerability location.
  2. The crash backtrace shows memory corruption in ccsv.so with a double free pattern.
  3. The vulnerability manifests specifically during CSV parsing operations handled by this function.
  4. The CWE-415 classification confirms the double free pattern matches the observed behavior.
  5. Though no patch is available, the reproduction case and technical details in Issue #15 demonstrate the function's flawed memory management logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** *or**** *un*tion in `*xt/**sv.*` in **sv *.*.* *llows r*mot* *tt**k*rs to **us* * **ni*l o* s*rvi** (*ou*l* *r** *n* *ppli**tion *r*s*) or possi*ly **v* unsp**i*i** ot**r imp**t vi* * *r**t** *il*.

Reasoning

*. Multipl* sour**s (*V*, **S*, ru*y-**visory-**) *xpli*itly i**nti*y t** *or**** *un*tion in *xt/**sv.* *s t** vuln*r**ility lo**tion. *. T** *r*s* ***ktr*** s*ows m*mory *orruption in **sv.so wit* * *ou*l* *r** p*tt*rn. *. T** vuln*r**ility m*ni**s