PT-2018-17487 · Facebook · Hhvm+1

Fred Emmott · Publicado 2018-12-31 · Atualizado 2025-05-06 · CVE-2018-6337

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions HHVM versions prior to 3.26.3 folly library versions between v2017.12.11.00 and v2018.08.09.00

Description The issue is related to the folly::secureRandom function, which re-uses a buffer between parent and child processes when fork() is called. This results in multiple forked children producing repeat or similar results.

Recommendations For HHVM versions prior to 3.26.3, update to version 3.26.3 or later. For folly library versions between v2017.12.11.00 and v2018.08.09.00, update to a version outside of this range.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-212

CWE-119

Identificadores relacionados

CVE-2018-6337

Produtos afetados

Hhvm

Folly

Referências · 7

• https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761f · Correção
• https://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-6337 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-6337 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6337 · Nota
• https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.html · Aviso do Fabricante
• https://t.me/cvenotify/121050 · Publicação no Telegram