CVE-2022-28739
📋 TL;DR
This vulnerability is a buffer over-read in Ruby's String-to-Float conversion functions (Kernel#Float and String#to_f). It allows attackers to read memory beyond allocated buffers, potentially exposing sensitive information or causing crashes. Affected users include anyone running vulnerable Ruby versions in applications that process untrusted string input.
💻 Affected Systems
- Ruby
📦 What is this software?
Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Ruby by Ruby Lang
Ruby by Ruby Lang
Ruby by Ruby Lang
Ruby by Ruby Lang
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure leading to exposure of sensitive data like passwords, keys, or application memory contents; potential denial of service through application crashes.
Likely Case
Application crashes or instability when processing maliciously crafted string inputs; potential information leakage in memory contents.
If Mitigated
Limited impact with proper input validation and sandboxing; crashes contained within affected processes.
🎯 Exploit Status
Exploitation requires crafting specific string inputs; public disclosures include technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Ruby 2.6.10, 2.7.6, 3.0.4, 3.1.2 or later
Vendor Advisory: https://www.ruby-lang.org/en/news/2022/04/12/buffer-overread-in-string-to-float-cve-2022-28739/
Restart Required: Yes
Instructions:
1. Update Ruby using your package manager (apt, yum, brew) or compile from source. 2. For RVM/rbenv: rvm install ruby-3.1.2 or rbenv install 3.1.2. 3. Restart all Ruby processes and applications.
🔧 Temporary Workarounds
Input Validation
allValidate and sanitize all string inputs before float conversion
# Example Ruby validation
input = params[:float_input]
if input.match?(/\A\d+(\.\d+)?\z/)
value = input.to_f
else
# Handle invalid input
end
🧯 If You Can't Patch
- Implement strict input validation for all string-to-float conversions
- Isolate Ruby applications in containers or VMs with limited network access
🔍 How to Verify
Check if Vulnerable:
Run: ruby -v and compare with affected versionsCheck Version:
ruby -vVerify Fix Applied:
Confirm version is 2.6.10+, 2.7.6+, 3.0.4+, or 3.1.2+📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Unexpected memory access errors in logs
Network Indicators:
- Unusual string patterns in input data
SIEM Query:
source="application.log" AND ("segmentation fault" OR "buffer over-read" OR "Float conversion error")🔗 References
- http://seclists.org/fulldisclosure/2022/Oct/28
- http://seclists.org/fulldisclosure/2022/Oct/29
- http://seclists.org/fulldisclosure/2022/Oct/30
- http://seclists.org/fulldisclosure/2022/Oct/41
- http://seclists.org/fulldisclosure/2022/Oct/42
- https://hackerone.com/reports/1248108
- https://lists.debian.org/debian-lts-announce/2023/06/msg00012.html
- https://security-tracker.debian.org/tracker/CVE-2022-28739
- https://security.gentoo.org/glsa/202401-27
- https://security.netapp.com/advisory/ntap-20220624-0002/
- https://support.apple.com/kb/HT213488
- https://support.apple.com/kb/HT213493
- https://support.apple.com/kb/HT213494
- https://www.ruby-lang.org/en/news/2022/04/12/buffer-overrun-in-string-to-float-cve-2022-28739/
- http://seclists.org/fulldisclosure/2022/Oct/28
- http://seclists.org/fulldisclosure/2022/Oct/29
- http://seclists.org/fulldisclosure/2022/Oct/30
- http://seclists.org/fulldisclosure/2022/Oct/41
- http://seclists.org/fulldisclosure/2022/Oct/42
- https://hackerone.com/reports/1248108
- https://lists.debian.org/debian-lts-announce/2023/06/msg00012.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00000.html
- https://security-tracker.debian.org/tracker/CVE-2022-28739
- https://security.gentoo.org/glsa/202401-27
- https://security.netapp.com/advisory/ntap-20220624-0002/
- https://support.apple.com/kb/HT213488
- https://support.apple.com/kb/HT213493
- https://support.apple.com/kb/HT213494
- https://www.ruby-lang.org/en/news/2022/04/12/buffer-overrun-in-string-to-float-cve-2022-28739/
