Drew Yao of Apple Product Security reported a flaw in how Ruby's BigDecimal implementation. In a 64-bit program, if the amount of memory to allocate is greater than 2^32, the allocated amount will be truncated to a 32-bit unsigned integer, however the amount to memset will use the full 64-bit number, leading to a crash or memory corruption. After the memset, the unexpectedly small buffer could be used in other ways that lead to memory corruption or, possibly, code execution. This flaw only affects 64-bit processes. To test whether or not ruby is vulnerable, the following can be used (on a vulnerable ruby it will cause a segfault): $ ruby -e 'require "bigdecimal"; BigDecimal.new("8").**(0x20000000)' Upstream committed the following to fix the flaw: http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ext/bigdecimal/bigdecimal.c?r1=29364&r2=30993
Acknowledgements: Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.
This issue has been addressed in following products: Red Hat Enterprise Linux 4 Via RHSA-2011:0908 https://rhn.redhat.com/errata/RHSA-2011-0908.html
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2011:0910 https://rhn.redhat.com/errata/RHSA-2011-0910.html
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2011:0909 https://rhn.redhat.com/errata/RHSA-2011-0909.html
Statement: (none)