-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| passenger | rubygems | >= 5.3.0, < 5.3.2 | 5.3.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the order of operations in handling the preloader's reported PID. The original code in SmartSpawner.h (lines 843-850) created a ScopeGuard to kill the PID immediately after receiving it, before performing UID validation. The patch moved this guard after the validation checks (lines 941-943 in the diff). This confirms that the pre-patch code allowed killing unvalidated PIDs, directly enabling the exploit described in CVE-2018-12028. The CWE-732 mapping (incorrect permission/resource control) aligns with the lack of PID validation before taking destructive actions.