CVE-2022-27810: High severity facebook hermes vulnerability

Q: What is CVE-2022-27810?

CVE-2022-27810 is a vulnerability in Hermes, a JavaScript engine developed by Facebook, which allows for an infinite recursion condition in the error handler.

Q: What is the severity of CVE-2022-27810?

CVE-2022-27810 has a severity rating of 7.5, which is considered high.

Q: Which versions of Hermes are affected by CVE-2022-27810?

Versions of Hermes prior to v0.12.0 are affected by CVE-2022-27810.

Q: How can CVE-2022-27810 be triggered?

CVE-2022-27810 can be triggered by executing specific maliciously formed JavaScript in dev-mode (when asserts were enabled).

Q: How can I mitigate the vulnerability in Hermes?

To mitigate the vulnerability in Hermes, it is recommended to update to version v0.12.0 or higher.

Published Oct 6, 2022

Updated

It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was only possible to trigger in dev-mode (when asserts were enabled). This issue affects Hermes versions prior to v0.12.0.

Affected Software

1 affected component

Facebook Hermes<0.12.0

Event History

Oct 6, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2022-27810?

CVE-2022-27810 is a vulnerability in Hermes, a JavaScript engine developed by Facebook, which allows for an infinite recursion condition in the error handler.

What is the severity of CVE-2022-27810?

CVE-2022-27810 has a severity rating of 7.5, which is considered high.

Which versions of Hermes are affected by CVE-2022-27810?

Versions of Hermes prior to v0.12.0 are affected by CVE-2022-27810.

How can CVE-2022-27810 be triggered?

CVE-2022-27810 can be triggered by executing specific maliciously formed JavaScript in dev-mode (when asserts were enabled).

How can I mitigate the vulnerability in Hermes?