CVE-2020-1899

The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/facebook/hhvm/commit/1107228a5128d3ca1c4add8ac1635d933cbbe2e9	Patch Third Party Advisory
https://hhvm.com/blog/2020/06/30/security-update.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:facebook:hhvm::::::::
	cpe:2.3:a:facebook:hhvm::::::::
	cpe:2.3:a:facebook:hhvm:4.57.0:::::::*
	cpe:2.3:a:facebook:hhvm:4.58.0:::::::*
	cpe:2.3:a:facebook:hhvm:4.58.1:::::::*
	cpe:2.3:a:facebook:hhvm:4.59.0:::::::*
	cpe:2.3:a:facebook:hhvm:4.60.0:::::::*
	cpe:2.3:a:facebook:hhvm:4.61.0:::::::*
	cpe:2.3:a:facebook:hhvm:4.62.0:::::::*

History

No history.

Information

Published : 2021-03-11 01:15

Updated : 2024-02-28 18:08

NVD link : CVE-2020-1899

Mitre link : CVE-2020-1899

CVE.ORG link : CVE-2020-1899

JSON object : View

Products Affected

facebook

hhvm

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-822

Untrusted Pointer Dereference

{"id": "CVE-2020-1899", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-03-11T01:15:14.333", "references": [{"url": "https://github.com/facebook/hhvm/commit/1107228a5128d3ca1c4add8ac1635d933cbbe2e9", "tags": ["Patch", "Third Party Advisory"], "source": "cve-assign@fb.com"}, {"url": "https://hhvm.com/blog/2020/06/30/security-update.html", "tags": ["Vendor Advisory"], "source": "cve-assign@fb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}, {"type": "Secondary", "source": "cve-assign@fb.com", "description": [{"lang": "en", "value": "CWE-822"}]}], "descriptions": [{"lang": "en", "value": "The unserialize() function supported a type code, \"S\", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0."}, {"lang": "es", "value": "La funci\u00f3n unserialize() admit\u00eda un c\u00f3digo de tipo, \"S\", que estaba destinado a ser admitido solo para la serializaci\u00f3n APC. Este c\u00f3digo de tipo permit\u00eda acceder a direcciones de memoria arbitrarias como si fueran objetos StringData est\u00e1ticos. Este problema afect\u00f3 a HHVM versiones anteriores a v4.32.3, entre las versiones 4.33.0 y 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0"}], "lastModified": "2021-03-18T14:14:23.757", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D2372F3F-5757-4097-BA67-61D7597F6D65", "versionEndExcluding": "4.32.3"}, {"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E83916FC-54F0-4A1B-99AD-0B81774170EE", "versionEndExcluding": "4.56.1", "versionStartIncluding": "4.33.0"}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.57.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F80C7A6-7FD9-4EAB-8533-F5C8ABF9F258"}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.58.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2006DF19-68B4-4139-AAAF-7F81B9742DA7"}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.58.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A9D0CEF-7EC2-421B-A45D-48D9663DB60B"}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.59.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "169B4C73-75D5-46FD-BADB-384ABFB9A6C9"}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.60.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A48FC296-D7B6-4B58-A386-9F5F5F6294AF"}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.61.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F702D76-27C2-4798-BF3C-242906E8E697"}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.62.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC078675-9A81-4B74-8818-0FFE9AF66296"}], "operator": "OR"}]}], "sourceIdentifier": "cve-assign@fb.com"}