Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| msgpack | rubygems | <= 1.8.1 | 1.8.2 |
Miggo AIRoot Cause AnalysisThe vulnerability is a use-after-free in the msgpack-ruby library, specifically within the MessagePack::Buffer#clear method. The provided security advisory and commit patch make it clear that the root cause is in the underlying C implementation. The MessagePack::Buffer#clear Ruby method calls a C function, which eventually calls _msgpack_buffer_shift_chunk in ext/msgpack/buffer.c. This C function is responsible for clearing the buffer's memory chunks. Before the patch, this function would free the memory pages but would not nullify the internal rmem_last, rmem_end, and rmem_owner pointers that tracked the buffer's memory region. As a result, the buffer object was left in an inconsistent state, holding stale pointers to freed memory. When a subsequent write operation occurred on this cleared buffer, it would be given a slice of this already-freed memory. If another buffer was then created, it could be allocated the same memory page from the pool, causing the two buffers to share the same memory region. This use-after-free condition could be exploited to read or write data across different buffers, leading to information disclosure or data corruption. The patch fixes this by explicitly setting the rmem_end, rmem_last, and rmem_owner pointers to NULL within the _msgpack_buffer_shift_chunk function when the buffer becomes empty, thus preventing any further use of the freed memory.
_msgpack_buffer_shift_chunkext/msgpack/buffer.c