GHSA-w39f-xq2m-4g8x: 
Ruby vulnerability analysis and mitigation

Summary

Dalli buffered request bytes in Ruby's IO write buffer (sync = false), and quiet (multi) blocks don't flush until they end. When the process forks, the child inherits the buffer, and Ruby flushes it when the child closes or finalizes the socket, even if the child never uses Dalli. The request is sent twice.

Impact

• A buffered write is applied twice (for example one incr increments by 2).
• A buffered non-quiet request leaves the parent's connection off by one reply, so later reads return the previous key's value.
• With TLS, the child's close sends close_notify on the shared connection and tears down the parent's session. Applications that fork while threads use a shared client are affected (pre-forking servers, job runners).

Affected versions

• Duplicated requests and the off-by-one connection: 4.2.0 and later (earlier versions don't buffer writes in Ruby).
• TLS session teardown: all versions with TLS.

Fix

Dalli buffers requests itself with the socket in sync mode, a forked child discards that buffer, and a forked child closes only its own file descriptor, without a TLS shutdown. Fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12.

Incomplete fix in 4.3.6 and 3.2.12

Fixed in 4.3.7 and 3.2.13:

• 4.3.6 and 3.2.12 detected a fork with a pid cache refreshed by a Process._fork hook. When another library's fork hook ran first in the child (connection_pool, loaded before Dalli as in Rails, closes its connections there), the TLS teardown still happened. Fork detection now checks Process.pid, as 5.x does.
• 4.3.6's new write buffer kept a reference to the caller's value string with the meta protocol, so changing that string before the buffer was sent (for example, reusing one buffer inside a quiet block) changed the bytes sent. The buffer now holds a copy.