PT-2022-5007 · Facebook · Hermes

Published 2022-10-10 · Updated 2022-10-11 · CVE-2022-32234

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hermes versions prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1

Description The issue is related to an out of bounds write in Hermes while handling large arrays, which can potentially allow attackers to execute arbitrary code via crafted JavaScript. This is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Most React Native applications are not affected.

Recommendations For versions prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the evaluation of untrusted JavaScript in applications using Hermes.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-06220

CVE-2022-32234

Affected Products

Hermes

References · 6

• https://github.com/facebook/hermes/commit/06eaec767e376bfdb883d912cb15e987ddf2bda1 · Patch
• https://bdu.fstec.ru/vul/2022-06220 · Security Note
• https://facebook.com/security/advisories/CVE-2022-32234 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-32234 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32234 · Security Note
• https://t.me/cibsecurity/51092 · Telegram Post