PT-2022-5008 · Facebook · Hermes

Published 2022-10-10 · Updated 2022-10-11 · CVE-2022-40138

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hermes versions prior to commit 6aa825e480d48127b480b08d13adf70033237097

Description The issue is related to an integer conversion error in Hermes bytecode generation. This error could be used to perform Out-Of-Bounds operations and subsequently execute arbitrary code. The exploitation of this issue is only possible in cases where Hermes is used to execute untrusted JavaScript. Most React Native applications are not affected due to this requirement.

Recommendations For versions prior to commit 6aa825e480d48127b480b08d13adf70033237097, update to a version that includes the fix for the integer conversion error in Hermes bytecode generation. As a temporary workaround, consider restricting the execution of untrusted JavaScript in Hermes to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-681

Related Identifiers

BDU:2022-06221

CVE-2022-40138

Affected Products

Hermes

References · 6

• https://github.com/facebook/hermes/commit/6aa825e480d48127b480b08d13adf70033237097 · Patch
• https://osv.dev/vulnerability/CVE-2022-40138 · Vendor Advisory
• https://facebook.com/security/advisories/CVE-2022-40138 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06221 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-40138 · Security Note
• https://t.me/cibsecurity/51093 · Telegram Post