CVE-2025-13120
📋 TL;DR
This CVE describes a use-after-free vulnerability in mruby's sort_cmp function that could allow local attackers to execute arbitrary code or cause denial of service. The vulnerability affects mruby versions up to 3.4.0. Systems using vulnerable mruby versions are at risk if untrusted users have local access.
💻 Affected Systems
- mruby
📦 What is this software?
Mruby by Mruby
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise, arbitrary code execution, or persistent backdoor installation.
Likely Case
Denial of service through application crashes or limited privilege escalation within the mruby context.
If Mitigated
Minimal impact if proper access controls prevent untrusted local users from executing mruby code.
🎯 Exploit Status
Exploit requires local access and knowledge of the system. The vulnerability has been publicly disclosed with technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit eb398971bfb43c38db3e04528b68ac9a7ce509bc
Vendor Advisory: https://github.com/mruby/mruby/commit/eb398971bfb43c38db3e04528b68ac9a7ce509bc
Restart Required: Yes
Instructions:
1. Update mruby to a version containing commit eb398971bfb43c38db3e04528b68ac9a7ce509bc
2. Recompile any applications using mruby
3. Restart affected services
🔧 Temporary Workarounds
Restrict local access
allLimit local user access to systems running vulnerable mruby versions
Disable unnecessary mruby functionality
allIf possible, disable or restrict array sorting functionality in mruby
🧯 If You Can't Patch
- Implement strict access controls to prevent untrusted local users from executing mruby code
- Monitor systems for unusual process behavior or crashes related to mruby execution
🔍 How to Verify
Check if Vulnerable:
Check mruby version with 'mruby --version' or examine installed packages. Versions <= 3.4.0 are vulnerable.Check Version:
mruby --versionVerify Fix Applied:
Verify the commit hash contains eb398971bfb43c38db3e04528b68ac9a7ce509bc or check for version > 3.4.0📡 Detection & Monitoring
Log Indicators:
- Segmentation faults in mruby processes
- Unexpected process termination of mruby applications
- Unusual memory access patterns
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
Process termination events for mruby executables OR segmentation fault errors containing 'mruby'🔗 References
- https://github.com/makesoftwaresafe/mruby/pull/263
- https://github.com/mruby/mruby/
- https://github.com/mruby/mruby/commit/eb398971bfb43c38db3e04528b68ac9a7ce509bc
- https://github.com/mruby/mruby/issues/6649
- https://github.com/mruby/mruby/issues/6649#issue-3534393003
- https://vuldb.com/?ctiid.332325
- https://vuldb.com/?id.332325
- https://vuldb.com/?submit.683435
