https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 19:44:57 +0000 https://db.gcve.eu/vuln/cve-2026-54522 <p><strong>Affected:</strong> msgpack-ruby</p> <p>MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.</p> <p><strong>Affected:</strong> msgpack-ruby</p> <p>MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.</p> https://db.gcve.eu/vuln/cve-2026-54522 https://db.gcve.eu/vuln/ghsa-4mrv-5p47-p938 <p><strong>Affected:</strong> RubyGems: msgpack</p> <p>### Summary `MessagePack::Buffer#clear` shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer&#39;s rmem cursor (`rmem_last`, `rmem_end`, `rmem_owner`). The next write sees &#34;unused rmem space&#34; left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second `MessagePack::Buffer` then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer&#39;s bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).</p> <p>### Details - `msgpack_buffer_clear()` → `_msgpack_buffer_shift_chunk()` (`ext/msgpack/buffer.c:151`, `:128`) destroys chunks (`_msgpack_buffer_chunk_destroy`, `:58`, returns the page via `msgpack_rmem_free`) but resets only `tail_buffer_end`/`read_buffer`, leaving `rmem_last`/`rmem_end`/`rmem_owner` pointing into the freed page. - Next `Buffer#write` → `_msgpack_buffer_chunk_malloc()` reuse branch (`:363`) returns `b-&gt;rmem_last`, a pointer into the already-freed page. - A second buffer&#39;s first write calls `msgpack_rmem_alloc()` and gets the same physical page back from the pool → the two buffers alias the same memory. - Sanitizer note: rmem (`ext/msgpack/rmem.h`) recycles pages with a slab bitmask, not `free()`, so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.</p> <p>### PoC Single self-contained script (builds msgpack from rubygems with AddressSanitiz…</p> <p><strong>Affected:</strong> RubyGems: msgpack</p> <p>### Summary `MessagePack::Buffer#clear` shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer&#39;s rmem cursor (`rmem_last`, `rmem_end`, `rmem_owner`). The next write sees &#34;unused rmem space&#34; left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second `MessagePack::Buffer` then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer&#39;s bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).</p> <p>### Details - `msgpack_buffer_clear()` → `_msgpack_buffer_shift_chunk()` (`ext/msgpack/buffer.c:151`, `:128`) destroys chunks (`_msgpack_buffer_chunk_destroy`, `:58`, returns the page via `msgpack_rmem_free`) but resets only `tail_buffer_end`/`read_buffer`, leaving `rmem_last`/`rmem_end`/`rmem_owner` pointing into the freed page. - Next `Buffer#write` → `_msgpack_buffer_chunk_malloc()` reuse branch (`:363`) returns `b-&gt;rmem_last`, a pointer into the already-freed page. - A second buffer&#39;s first write calls `msgpack_rmem_alloc()` and gets the same physical page back from the pool → the two buffers alias the same memory. - Sanitizer note: rmem (`ext/msgpack/rmem.h`) recycles pages with a slab bitmask, not `free()`, so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.</p> <p>### PoC Single self-contained script (builds msgpack from rubygems with AddressSanitiz…</p> https://db.gcve.eu/vuln/ghsa-4mrv-5p47-p938