Log in Start free

Vulnerability · Published Jan 17, 2022 · Assigned by @huntrdev

CVE-2022-0240NULL Pointer Dereference in mruby/mruby

Medium 6.2

In plain English

A medium-severity null pointer dereference in mruby/mruby from mruby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)6.2Medium
Exploit odds (30 days)1.0%top 38.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

mruby is vulnerable to NULL Pointer Dereference

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20mruby3.1.0-r0ALPINE-CVE-2022-0240
Alpine:v3.21mruby3.1.0-r0ALPINE-CVE-2022-0240
Alpine:v3.22mruby3.1.0-r0ALPINE-CVE-2022-0240
Alpine:v3.23mruby3.1.0-r0ALPINE-CVE-2022-0240
Alpine:v3.24mruby3.1.0-r0ALPINE-CVE-2022-0240
Debian:12mruby3.1.0-1DEBIAN-CVE-2022-0240
Debian:13mruby3.1.0-1DEBIAN-CVE-2022-0240
Debian:14mruby3.1.0-1DEBIAN-CVE-2022-0240
Ubuntu:22.04:LTSgroongano fix listedUBUNTU-CVE-2022-0240
Ubuntu:24.04:LTSgroongano fix listedUBUNTU-CVE-2022-0240
Ubuntu:25.10groongano fix listedUBUNTU-CVE-2022-0240
Ubuntu:26.04:LTSgroongano fix listedUBUNTU-CVE-2022-0240
Ubuntu:26.10groongano fix listedUBUNTU-CVE-2022-0240
Ubuntu:24.04:LTSh2ono fix listedUBUNTU-CVE-2022-0240
Ubuntu:22.04:LTSmrubyno fix listedUBUNTU-CVE-2022-0240
Ubuntu:24.04:LTSmrubyno fix listedUBUNTU-CVE-2022-0240
Ubuntu:25.10mrubyno fix listedUBUNTU-CVE-2022-0240
Ubuntu:26.04:LTSmrubyno fix listedUBUNTU-CVE-2022-0240
Ubuntu:26.10mrubyno fix listedUBUNTU-CVE-2022-0240

Affected products (as reported)

VendorProductVersions
mruby mruby/mruby unspecified – before 3.2

Weakness: CWE-476 · Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References