CVE-2024-27280 StringIO buffer overread vulnerability
Attackers can read past the end of a string in Ruby's StringIO library, potentially exposing sensitive memory values.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-27280?
CVE-2024-27280 is a critical vulnerability in n/a, published on 8 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however, for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is stringio 3.0.1.2.
Weakness: CWE-120
Which versions are affected by CVE-2024-27280?
2 open source packages ship an affected version, including stringio.
| Package | Affected | Fixed in |
|---|---|---|
stringio RubyGems | All versions | 3.0.1.1 |
stringio RubyGems | All versions | 3.0.1.1 |
How do I fix CVE-2024-27280?
Upgrade stringio to 3.0.1.1 or later.
Is CVE-2024-27280 being exploited?
There is no known exploitation of CVE-2024-27280 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2024-27280, BELL-CVE-2024-27280, CLEANSTART-2026-JV37320, CLSA-2026-1782469374, DEBIAN-CVE-2024-27280, GHSA-v5h6-c2hv-hv3r and 3 more.