CVE-2019-3570: facebook hhvm Heap-based Buffer Overflow

Vulnerability summary

CVE-2019-3570 is a critical (CVSS 9.8) Heap-based Buffer Overflow vulnerability in facebook hhvm. EPSS estimates a 1.68% chance of exploitation in the next 30 days, higher than 76.5% of scored vulnerabilities.

Timeline

1. 18-07-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p). This happens if the parameters are configurable by an attacker for instance by providing the output of scrypt_enc() in a context where Hack/PHP code would attempt to verify it by re-running scrypt_enc() with the same parameters. This could result in information disclosure, memory being overwriten or crashes of the HHVM process. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.

• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.