Ruby is a widely used programming language, prized for its elegance and simplicity. But even in the most polished tools, critical vulnerabilities can lurk beneath the surface. One such vulnerability is CVE-2022-28738, a double free found in the Regexp compiler affecting Ruby 3.x versions before 3..4 and 3.1.x before 3.1.2. This post will walk you through the details of this bug, its risks, and how an attacker might exploit it, all in easy-to-understand language.

What is the CVE-2022-28738 Bug?

A "double free" happens when a program tries to free (or release) the same area of memory more than once. Freeing memory twice can corrupt vital program data or allow attackers to write to protected memory areas. When this kind of bug is in a component that handles user input, it's especially dangerous.

In Ruby, regular expressions are handled by a component known as the Regexp compiler. This bug was found in how Ruby handled errors while compiling regular expressions. If a malicious input is processed, the compiler could end up freeing the same chunk of memory twice, opening the door to all sorts of memory corruption exploits.

How Does the Exploit Work?

Let's imagine your application takes user input and builds a Regexp from it—a common pattern in web or API servers. If you do this naively, like below, your app is vulnerable:

# Vulnerable code example
user_input = gets.chomp   # (could also come from the web, e.g. params[:search])
unsafe_regexp = Regexp.new(user_input)

If an attacker submits a specially-crafted regular expression causing a compilation error, it triggers the bug. This error path tries to free memory that's already been freed. With careful memory manipulation, an attacker could exploit this for unauthorized memory writes – potentially leading to remote code execution.

The Ruby security team didn't release a proof-of-concept, but a basic idea might look like this

input = '(?>a|)'  # Crafted input that triggers regex compiler error paths
Regexp.new(input)

> Note: Successfully exploiting double free bugs often requires precise heap manipulations, which vary between systems and Ruby builds.

If you're interested in the technical nitty-gritty or want official Ruby guidance, check out these links:

- Official Ruby Announcement
- CVE-2022-28738 at NIST
- Ruby Regexp Source (GitHub)

Why is This Dangerous?

While direct memory exploits in Ruby are rare (Ruby runs with a lot of safety checks), a double free can sometimes let attackers:

Upgrade immediately to a fixed version of Ruby! Find your Ruby version by running

ruby --version

If on 3.1.x, upgrade to 3.1.2 or later

You can update using your package manager or rbenv/rvm/asdf.

Never build regular expressions directly with untrusted user input!
Always sanitize and validate what you pass to Regexp.new, no matter which Ruby version.

CVE-2022-28738 affects Ruby’s Regexp compiler in versions before 3..4 and 3.1.2.

- This is a double free vulnerability: crafted input can make Ruby free the same memory twice, which attackers might exploit.

Stay safe, keep your dependencies updated, and never trust user input!

*This post is an exclusive, simplified explanation for understanding CVE-2022-28738 and its possible impacts on Ruby applications. For more technical details, review the original advisory and always check for the latest security guidance.*

Timeline

Published on: 05/09/2022 18:15:00 UTC
Last modified on: 06/24/2022 16:15:00 UTC