CVE-2020-1900: Facebook HHVM, грешка в паметта

Описание

Оригинално описание

When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it. Otherwise the array might resize, invalidating previously stored references. This pre-reservation was not occurring in HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.

Засегнати продукти

• Facebook HHVM: 4.62.1 преди unspecified; 4.62.0; 4.61.1 преди unspecified; 4.61.0; 4.60.1 преди unspecified; 4.60.0; 4.59.1 преди unspecified; 4.59.0; 4.58.2 преди unspecified; 4.58.0 преди unspecified; 4.57.1 преди unspecified; 4.57.0; 4.56.1 преди unspecified; 4.33.0 преди unspecified; 4.32.3 преди unspecified; unspecified преди 4.32.3

Вид слабост

• CWE-416 Използване на памет след освобождаване (Use-After-Free)

История

Други уязвимости в Facebook HHVM

• 9.8CVE-2022-36937
• CVE-2019-3556
• CVE-2021-24036
• CVE-2020-1899
• CVE-2020-1898

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2020-1900
• https://nvd.nist.gov/vuln/detail/CVE-2020-1900
• https://hhvm.com/blog/2020/06/30/security-update.html
• https://github.com/facebook/hhvm/commit/c1c4bb0cf9e076aafaf4ff3515556ef9faf906f3