A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations.
The product calls free() twice on the same memory address.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ruby | Ruby-lang | 3.0.0 (including) | 3.0.4 (excluding) |
| Ruby | Ruby-lang | 3.1.0 (including) | 3.1.2 (excluding) |
| Red Hat Enterprise Linux 8 | RedHat | ruby:3.0-8060020220810162001.ad008a3a | * |
| Red Hat Enterprise Linux 9 | RedHat | ruby-0:3.0.4-160.el9_0 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-ruby30-ruby-0:3.0.4-149.el7 | * |
| Ruby3.0 | Ubuntu | jammy | * |
| Ruby3.0 | Ubuntu | upstream | * |