by Kastro
Paper/Archive/CVE-2021-24036

CVE-2021-24036

Facebook folly — Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap wi…

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 88.5.885 × 2017.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1.

Affected

ProductAffectedFixed inSource
follyunspecified – < v2021.07.22.00v2021.07.22.00CNA
HHVM4.118.0 – < unspecifiedunspecifiedCNA
HHVM4.117.04.118.2CNA
HHVM4.116.04.118.2CNA
HHVM4.115.04.118.2CNA
HHVM4.114.04.118.2CNA
HHVM4.113.04.118.2CNA
HHVM4.102.0 – < unspecifiedunspecifiedCNA
HHVM4.81.0 – < unspecifiedunspecifiedCNA
HHVMunspecified – < 4.80.54.80.5CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refhhvm.com/blog/2021/07/20/security-update.htmlrefgithub.com/facebook/folly/commit/4f304af1411e68851bdd00ef6140e9de4616f7d3reffacebook.com/security/advisories/cve-2021-24036