PT-2022-9436 · Hermes · Hermes

Published 2022-01-15 · Updated 2022-01-24 · CVE-2021-24044

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hermes versions prior to v0.10.0

Description The issue arises when invalid JavaScript code is passed, specifically where await and yield are called on non-async and non-generator getter/setter functions. This causes Hermes to invoke generator functions and error out due to invalid await/yield positions, potentially resulting in a segmentation fault as a consequence of a type confusion error. There is a low chance of remote code execution (RCE) associated with this issue.

Recommendations For versions prior to v0.10.0, update to version v0.10.0 or later to resolve the issue. As a temporary workaround, consider restricting the execution of invalid JavaScript code that invokes await and yield on non-async and non-generator functions until a patch is applied.

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2021-24044

GHSA-7MHC-PRGV-R3Q4

Affected Products

Hermes

References · 7

• https://osv.dev/vulnerability/GHSA-7mhc-prgv-r3q4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24044 · Security Note
• https://facebook.com/security/advisories/cve-2021-24044 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-24044 · Vendor Advisory
• https://github.com/facebook/hermes · Note
• https://t.me/cvenotify/25527 · Telegram Post
• https://t.me/cibsecurity/35643 · Telegram Post