CVE-2025-13120

Executive Summary

CVE-2025-13120 is a use-after-free vulnerability in the sort_cmp function within src/array.c of the mruby programming language, affecting versions up to and including 3.4.0. This flaw can be triggered locally by an attacker, potentially leading to memory corruption, data integrity compromise, or denial of service. The vulnerability has been publicly disclosed, and a patch is available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the public availability of exploit details necessitates immediate patching for affected systems.

Supply Chain & Package Security

mruby is a lightweight Ruby implementation often embedded in larger applications or used as a scripting engine. This vulnerability could be introduced into a supply chain if a project depends on a vulnerable version of mruby. Organizations should audit their dependencies for mruby versions <= 3.4.0 and update to the patched version.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The medium severity reflects the local attack vector and limited impact, but the public exploit disclosure raises the practical risk.

Deep Dive & Mechanics

The vulnerability resides in the sort_cmp function used during array sorting operations. When sorting an array, mruby calls a comparison function (sort_cmp) that may invoke user-defined blocks or methods. If the comparison block modifies the array being sorted (e.g., by adding or removing elements), it can cause the underlying memory to be freed and reallocated. The sort_cmp function then continues to use the original pointer, leading to a use-after-free condition.

Root Cause: The sort_cmp function does not properly handle the case where the array is mutated during comparison. This allows an attacker to craft a Ruby script that, when executed, triggers the use-after-free.

Attack Scenario: An attacker with local access to a system running a vulnerable mruby interpreter can execute a specially crafted Ruby script that sorts an array while a custom comparison block modifies the array. This can lead to arbitrary code execution or a crash.

Vulnerable vs. Patched Code

Vulnerable Code (mruby <= 3.4.0):

// src/array.c (simplified)
static int sort_cmp(mrb_state *mrb, mrb_value a, mrb_value b) {
    // ... calls user block
    // No check if array was modified during comparison
    return mrb_fixnum(mrb_funcall(mrb, block, "call", 2, a, b));
}

Patched Code (after commit eb398971bfb43c38db3e04528b68ac9a7ce509bc):

// src/array.c (simplified)
static int sort_cmp(mrb_state *mrb, mrb_value a, mrb_value b) {
    // ... calls user block
    // Added check for array modification
    if (mrb->c->ci->stack < mrb->c->stbase) {
        mrb_raise(mrb, E_RUNTIME_ERROR, "array modified during sort");
    }
    return mrb_fixnum(mrb_funcall(mrb, block, "call", 2, a, b));
}

The patch adds a runtime check to detect if the array has been modified during the sort operation, raising an error instead of allowing the use-after-free.

Exploitation & Lab Setup

Red Team

Proof of Concept (PoC):

# exploit.rb
a = [1, 2, 3]
a.sort! do |x, y|
  a.clear  # Modify array during sort
  x <=> y
end

Lab Setup:

1. Install mruby 3.4.0 on a test system.
2. Create the PoC script exploit.rb.
3. Run: mruby exploit.rb
4. Observe crash or memory corruption.

Expected Outcome: The script will likely cause a segmentation fault or undefined behavior due to the use-after-free.

Blue Team

Detection:

• Monitor for crashes in mruby processes.
• Look for Ruby scripts that modify arrays inside sort blocks.
• Use the YARA and Sigma rules below to detect malicious scripts.

Mitigation:

• Apply the patch immediately.
• Restrict execution of untrusted Ruby scripts.
• Use application whitelisting to control which scripts can run.

Indicators of Compromise (IOCs)

• File Hashes (PoC script):
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• Process Anomalies:
  • mruby process crashes with SIGSEGV.
• Network: None (local vulnerability).
• Logs: Application logs showing "array modified during sort" errors (if patched) or unexplained crashes.

Detection Engineering

YARA Rule

rule CVE_2025_13120_mruby_use_after_free {
    meta:
        description = "Detects mruby scripts exploiting CVE-2025-13120"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-13120"
    strings:
        $s1 = ".sort!" nocase
        $s2 = ".sort" nocase
        $s3 = "do |" nocase
        $s4 = "a.clear" nocase
        $s5 = "a.delete" nocase
        $s6 = "a.push" nocase
    condition:
        all of ($s1, $s3) and any of ($s4, $s5, $s6)
}

Sigma Rule

title: CVE-2025-13120 mruby Use-After-Free Exploitation
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects mruby scripts that modify arrays during sort operations
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/mruby'
        CommandLine|contains: '.sort'
    filter:
        CommandLine|contains: 'a.clear' or 'a.delete' or 'a.push'
    condition: selection and filter
falsepositives:
    - Legitimate scripts that modify arrays during sort (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-13120 mruby Use-After-Free Exploit"; content:"|2e 73 6f 72 74|"; nocase; content:"|61 2e 63 6c 65 61 72|"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Update mruby to a version that includes commit eb398971bfb43c38db3e04528b68ac9a7ce509bc or later.
2. Code Review: Review any custom mruby scripts for array modification inside sort blocks.
3. Access Control: Limit local access to systems running mruby.
4. Monitoring: Implement the detection rules above to identify exploitation attempts.
5. Backup: Ensure backups are available in case of data corruption.

Valters IT