PT-2022-5006 · Facebook · Hermes

Published 2022-10-10 · Updated 2022-10-11 · CVE-2022-35289

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hermes versions prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374

Description A write-what-where condition in Hermes caused by an integer overflow allows attackers to potentially execute arbitrary code via crafted JavaScript. This issue is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Most React Native applications are not affected.

Recommendations For versions prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374, consider updating to a version that includes the fix for the integer overflow issue. As a temporary workaround, restrict the evaluation of untrusted JavaScript in applications using Hermes to minimize the risk of exploitation.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

CWE-680

Related Identifiers

BDU:2022-06219

CVE-2022-35289

Affected Products

Hermes

References · 6

• https://github.com/facebook/hermes/commit/5b6255ae049fa4641791e47fad994e8e8c4da374 · Patch
• https://facebook.com/security/advisories/CVE-2022-35289 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-35289 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06219 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-35289 · Security Note
• https://t.me/cibsecurity/51091 · Telegram Post