From: "hakuopi (haku opi) via ruby-core" <ruby-core@...>
Date: 2026-06-13T04:57:53+00:00
Subject: [ruby-core:125733] [Ruby Bug#22110] Ruby::Box C-extension loading can be denied by predictable temporary filename

Issue #22110 has been reported by hakuopi (haku opi).

----------------------------------------
Bug #22110: Ruby::Box C-extension loading can be denied by predictable temporary filename
https://bugs.ruby-lang.org/issues/22110

* Author: hakuopi (haku opi)
* Status: Open
* ruby -v: ruby 4.1.0dev (2026-06-13 master 533abc7ded) [x86_64-linux]
* Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN
----------------------------------------
Ruby::Box is experimental, but I found a reproducible local hardening issue in its native extension loading path.

When a C extension is required inside a Ruby::Box, Ruby copies the `.so` to a temporary filename derived from predictable values:

```text
tmpdir + "_ruby_box_" + "p" + getpid() + "_" + box_id + "_" + escaped_basename
```

Because the filename has no random component, another same-host local user can pre-create the path before the victim process loads the extension. The victim���s `open(..., O_CREAT|O_EXCL, ...)` call then fails, and `require` raises `LoadError`.

This does not allow code injection. `O_CREAT|O_EXCL` correctly rejects pre-existing files and symlinks. The impact is only denial of Ruby::Box C-extension loading.

Environment:
Ruby 4.1.0-dev @ 533abc7ded
Ruby::Box enabled with `RUBY_BOX=1`
Linux x86_64

Reproduction:
From a Ruby build tree with `./ruby` available:

```sh
RUBY=./ruby sh security_review_claude_opus48_max_20260613_050521/poc/box_dos_attack.sh
```

Observed:
The attacker process discovers the victim PID, pre-creates likely paths under `/tmp`, and the victim fails with:

```text
LoadError: can't prepare the extension file for Ruby Box (.../_ruby_box_p<pid>_4_fcntl.so from .../fcntl.so): can't open the file to write
```

Control:
Without pre-creating the path, the same Ruby::Box extension require succeeds.

Expected:
A third-party same-host user should not be able to deny Ruby::Box C-extension loading by pre-creating a predictable temp filename.

Suggested fix:
Use an unpredictable temporary filename, for example `mkstemp` or a random suffix, preferably inside a private per-process directory with `0700` permissions. The copied extension file can also use mode `0600` instead of mirroring the source `.so` permissions.

Notes:
This is not a sandbox escape, not code execution, not privilege escalation, and not information disclosure. It is a local denial/hardening issue for an experimental opt-in feature.


---Files--------------------------------
box_dos_attack.sh (1.98 KB)
box_poc_output.txt (1.11 KB)


-- 
https://bugs.ruby-lang.org/
______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/