PT-2021-10264 · Facebook · Hhvm

Jjergus · Published 2021-03-11 · Updated 2021-03-18 · CVE-2020-1899

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: HHVM versions prior to 4.32.3 HHVM versions 4.33.0 through 4.62.0

Description: The unserialize() function has a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects.

Recommendations: For HHVM versions prior to 4.32.3, update to version 4.32.3 or later. For HHVM versions 4.33.0 through 4.62.0, update to a version outside of this range, as these versions are affected by the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability for versions 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.

Fix

Untrusted Pointer Dereference

Buffer Overflow

Weakness Enumeration

CWE-822

CWE-119

Related Identifiers

CVE-2020-1899

Affected Products

Hhvm

References · 8

• https://github.com/facebook/hhvm/commit/1107228a5128d3ca1c4add8ac1635d933cbbe2e9 · Patch
• https://ubuntu.com/security/CVE-2020-1899 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1899 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-1899 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-1899 · Security Note
• https://hhvm.com/blog/2020/06/30/security-update.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1899 · Security Note
• https://t.me/cvenotify/11153 · Telegram Post