A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations.
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ruby | Ruby-lang | 3.0.0 (including) | 3.0.4 (excluding) |
| Ruby | Ruby-lang | 3.1.0 (including) | 3.1.2 (excluding) |
| Red Hat Enterprise Linux 8 | RedHat | ruby:3.0-8060020220810162001.ad008a3a | * |
| Red Hat Enterprise Linux 9 | RedHat | ruby-0:3.0.4-160.el9_0 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-ruby30-ruby-0:3.0.4-149.el7 | * |
| Ruby3.0 | Ubuntu | jammy | * |
| Ruby3.0 | Ubuntu | upstream | * |