PT-2021-15658 · Facebook · Folly+1

Published 2021-07-23 · Updated 2022-10-26 · CVE-2021-24036

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: folly versions prior to v2021.07.22.00 HHVM versions prior to 4.80.5 HHVM versions 4.81.0 through 4.102.1 HHVM versions 4.103.0 through 4.113.0 HHVM versions 4.114.0 through 4.118.1

Description: Passing an attacker-controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution.

Recommendations: For folly versions prior to v2021.07.22.00, update to version v2021.07.22.00 or later. For HHVM versions prior to 4.80.5, update to version 4.80.5 or later. For HHVM versions 4.81.0 through 4.102.1, update to a version outside of this range. For HHVM versions 4.103.0 through 4.113.0, update to a version outside of this range. For HHVM versions 4.114.0 through 4.118.1, update to a version later than 4.118.1. As a temporary workaround, consider restricting the creation of IOBuf with attacker-controlled sizes until a patch is available.

Fix

RCE

Integer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-190

CWE-122

Related Identifiers

CVE-2021-24036

Affected Products

Hhvm

Folly

References · 10

• https://github.com/facebook/folly/commit/4f304af1411e68851bdd00ef6140e9de4616f7d3 · Patch
• https://facebook.com/security/advisories/cve-2021-24036 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24036 · Security Note
• https://ubuntu.com/security/CVE-2021-24036 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-24036 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-24036 · Vendor Advisory
• https://hhvm.com/blog/2021/07/20/security-update.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-24036 · Security Note
• https://t.me/cibsecurity/26431 · Telegram Post
• https://t.me/cvenotify/18031 · Telegram Post