CVE-2017-0898 Memory corruption in Ruby

Critical 9.1 Published 15 Sep 2017 Updated 17 Sep 2024

A malicious format string in Ruby can cause heap memory corruption, potentially allowing code execution or information disclosure.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-0898?

CVE-2017-0898 is a critical memory corruption vulnerability in Ruby-Lang Ruby, published on 15 Sep 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap.

Weakness: CWE-134

Which versions are affected by CVE-2017-0898?

It affects 1 product.

Products include Ruby-Lang Ruby.

How do I fix CVE-2017-0898?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2017-0898 being exploited?

There is no known exploitation of CVE-2017-0898 in the wild and no public exploit code.

All Ruby-Lang Ruby vulnerabilities

Sources

Also known as ALPINE-CVE-2017-0898, CLEANSTART-2026-YB55994, GHSA-wvmx-3rv2-5jgf, UBUNTU-CVE-2017-0898.