PT-2019-16618 · Facebook · Hhvm

Published 2019-07-18 · Updated 2020-10-16 · CVE-2019-3570

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HHVM versions 3.30.5 and below HHVM versions 4.0 through 4.2 HHVM versions 4.3.0 through 4.8.0

Description A call to the scrypt enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r, and p). This occurs when an attacker can configure these parameters, for instance, by providing the output of scrypt enc() in a context where Hack/PHP code attempts to verify it by re-running scrypt enc() with the same parameters. This could result in information disclosure, memory being overwritten, or crashes of the HHVM process.

Recommendations For HHVM versions 3.30.5 and below, update to a version above 3.30.5. For HHVM versions 4.0 through 4.2, update to a version above 4.2. For HHVM versions 4.3.0 through 4.8.0, update to a version above 4.8.0. As a temporary workaround, consider restricting the use of the scrypt enc() function until a patch is available.

Fix

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-122

CWE-787

Related Identifiers

CVE-2019-3570

Affected Products

Hhvm

References · 7

• https://github.com/facebook/hhvm/commit/cc331e4349e91706a673e2a09f1f2ea5bbb33815 · Patch
• https://hhvm.com/blog/2019/06/10/hhvm-4.9.0.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3570 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-3570 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-3570 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-3570 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3570 · Vendor Advisory