Floating point exception vulnerability in mruby mruby-bigint

Vulnerability Overview Vulnerability Name: Floating point exception in mruby/mruby Vulnerability Type: CWE-369: Floating Point Comparison with Incorrect Operator Severity: Medium (5.9) Report Date: August 28, 2022 Affected Versions: mruby 3.0.0 Impact Scope Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Integrity: Low Availability: Low Remediation Fix Status: Fixed Fixer: Yukihiro "Matz" Matsumoto Fixed Version: Not specified Proof of Concept (POC) Code ASAN Output ```plaintext ==147==ERROR: AddressSanitizer: SEGV on unknown address 0x5626e0776d90 (pc 0x5626e0776d90 bp 0x7ffd6e0776d90 sp 0x7ffd6e0776d90 T0) #0 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #1 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #2 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #3 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #4 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #5 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #6 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #7 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #8 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #9 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #10 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #11 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #12 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #13 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #14 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #15 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #16 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #17 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #18 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #19 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #20 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #21 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #22 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #23 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #24 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #25 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #26 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #27 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #28 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #29 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #30 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #31 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #32 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #33 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #34 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #35 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #36 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #37 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #38 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #39 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #40 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #41 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bigint.c:100 #42 0x5626e0776d90 in mrb_float /home/botton/fuzz/mruby/mruby/mrbgems/mruby-bigint/core/bi

Goal Reached Thanks to every supporter — we hit 100%!

Floating point exception vulnerability in mruby mruby-bigint