PT-2023-19812 · Hermes · Hermes

Published 2023-05-18 · Updated 2025-01-21 · CVE-2023-24832

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Hermes versions prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708

Description A null pointer dereference bug could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config option was set to true. This is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Most React Native applications are not affected.

Recommendations For Hermes versions prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708, consider updating to a version that includes the fix for this issue. As a temporary workaround, consider setting the EnableHermesInternal config option to false to prevent exploitation. Restrict the execution of untrusted JavaScript in Hermes to minimize the risk of crashing the runtime.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2023-24832

Affected Products

Hermes

References · 8

• https://github.com/facebook/hermes/commit/5cae9f72975cf0e5a62b27fdd8b01f103e198708 · Patch
• https://osv.dev/vulnerability/CVE-2023-24832 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24832 · Security Note
• https://facebook.com/security/advisories/cve-2023-24832 · Vendor Advisory
• https://t.me/cvenotify/50775 · Telegram Post
• https://t.me/cibsecurity/64437 · Telegram Post
• https://t.me/cvenotify/108141 · Telegram Post
• https://t.me/cvenotify/51246 · Telegram Post