PT-2021-10310 · Facebook · Hhvm

Jjergus · Published 2021-03-10 · Updated 2021-03-15 · CVE-2020-1921

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: HHVM versions prior to 4.56.3 HHVM versions 4.57.0 through 4.80.1 HHVM versions 4.81.0 through 4.93.1 HHVM versions 4.94.0 through 4.98.0

Description: The issue arises in the crypt function where it attempts to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer.

Recommendations: For versions prior to 4.56.3, update to version 4.56.3 or later. For versions 4.57.0 through 4.80.1, update to version 4.80.2 or later. For versions 4.81.0 through 4.93.1, update to version 4.93.2 or later. For versions 4.94.0 through 4.98.0, update to a version later than 4.98.0. As a temporary workaround, consider disabling the crypt function until a patch is available.

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2020-1921

Affected Products

Hhvm

References · 8

• https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca · Patch
• https://ubuntu.com/security/CVE-2020-1921 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1921 · Security Note
• https://hhvm.com/blog/2021/02/25/security-update.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-1921 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1921 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-1921 · Vendor Advisory
• https://t.me/cvenotify/11101 · Telegram Post