CVE-2018-10191 Use after free in n/a
An attacker can execute arbitrary code by exploiting a use-after-free vulnerability in the mruby interpreter caused by an integer overflow during deep scope nesting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-10191?
CVE-2018-10191 is a critical use after free vulnerability in Debian Debian Linux, published on 17 Apr 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the presence of deep scope nesting, resulting in a use-after-free. An attacker that can cause Ruby code to be run can use this to possibly execute arbitrary code.
Weakness: CWE-190
Which versions are affected by CVE-2018-10191?
It affects 2 products.
Products include Debian Debian Linux, Mruby Mruby.
How do I fix CVE-2018-10191?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2018-10191 being exploited?
There is no known exploitation of CVE-2018-10191 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-10191, GHSA-444w-xm89-r2p5, UBUNTU-CVE-2018-10191.