by Kastro
Paper/Archive/CVE-2021-24025

CVE-2021-24025

Facebook HHVM — Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an inte…

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 76.7.767 × 2015.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow leading to a heap overflow. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

Affected

ProductAffectedFixed inSource
HHVM4.98.04.98.1CNA
HHVM4.97.04.98.1CNA
HHVM4.96.04.98.1CNA
HHVM4.95.04.98.1CNA
HHVM4.94.04.98.1CNA
HHVM4.81.0 – < unspecifiedunspecifiedCNA
HHVM4.57.0 – < unspecifiedunspecifiedCNA
HHVMunspecified – < 4.56.34.56.3CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refhhvm.com/blog/2021/02/25/security-update.htmlrefgithub.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca