PT-2018-17487 · Facebook · Hhvm+1

Fred Emmott · Published 2018-12-31 · Updated 2025-05-06 · CVE-2018-6337

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions HHVM versions prior to 3.26.3 folly library versions between v2017.12.11.00 and v2018.08.09.00

Description The issue is related to the folly::secureRandom function, which re-uses a buffer between parent and child processes when fork() is called. This results in multiple forked children producing repeat or similar results.

Recommendations For HHVM versions prior to 3.26.3, update to version 3.26.3 or later. For folly library versions between v2017.12.11.00 and v2018.08.09.00, update to a version outside of this range.

Fix

Buffer Overflow

Weakness Enumeration

CWE-212

CWE-119

Related Identifiers

CVE-2018-6337

Affected Products

Hhvm

Folly

References · 7

• https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761f · Patch
• https://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-6337 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6337 · Vendor Advisory
• https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6337 · Note
• https://t.me/cvenotify/121050 · Telegram Post