CVE-2020-1898: Facebook HHVM, отказ на услуга

Описание

Оригинално описание

The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.

Засегнати продукти

• Facebook HHVM: 4.62.1 преди unspecified; 4.62.0; 4.61.1 преди unspecified; 4.61.0; 4.60.1 преди unspecified; 4.60.0; 4.59.1 преди unspecified; 4.59.0; 4.58.2 преди unspecified; 4.58.0 преди unspecified; 4.57.1 преди unspecified; 4.57.0; 4.56.1 преди unspecified; 4.33.0 преди unspecified; 4.32.3 преди unspecified; unspecified преди 4.32.3

Вид слабост

• CWE-674 Uncontrolled Recursion

История

Други уязвимости в Facebook HHVM

• 9.8CVE-2022-36937
• CVE-2019-3556
• CVE-2021-24036
• CVE-2020-1900
• CVE-2020-1899

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2020-1898
• https://nvd.nist.gov/vuln/detail/CVE-2020-1898
• https://hhvm.com/blog/2020/06/30/security-update.html
• https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c