CVE-2020-1919: High severity facebook hiphop virtual machine vulnerability

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2020-1919.

Q: What is the severity of CVE-2020-1919?

The severity of CVE-2020-1919 is high, with a severity value of 7.5.

Q: Which software versions are affected by CVE-2020-1919?

CVE-2020-1919 affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, and 4.98.0.

Q: How does CVE-2020-1919 occur?

CVE-2020-1919 occurs due to incorrect bounds calculations in the substr_compare function, leading to an out-of-bounds read when the second string argument passed in is longer than the first.

Q: How can I fix CVE-2020-1919?

To fix CVE-2020-1919, it is recommended to update HHVM to a version that is not affected by the vulnerability.

Published Mar 10, 2021

Updated

Incorrect bounds calculations in substrcompare could lead to an out-of-bounds read when the second string argument passed in is longer than the first. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

Affected Software

8 affected components

Facebook HHVM<4.56.3

Facebook HHVM>=4.57.0<4.80.2

Facebook HHVM>=4.81.0<4.93.2

Facebook HHVM=4.94.0

Facebook HHVM=4.95.0

Facebook HHVM=4.96.0

Facebook HHVM=4.97.0

Facebook HHVM=4.98.0

Remediation

Patch Available

https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca

Event History

Mar 10, 2021

CVE Published

via MITRE·03:50 PM

Data Sourced

via MITRE·03:50 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2020-1919.

What is the severity of CVE-2020-1919?

The severity of CVE-2020-1919 is high, with a severity value of 7.5.

Which software versions are affected by CVE-2020-1919?