GHSA-gmpm-xp43-f7g6: High severity Facebook Hermes vulnerability

Published Sep 9, 2020

Updated

An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows attackers to cause a denial of service attack or a potential RCE via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

Affected Software

1 affected component

Facebook Hermes

Event History

Sep 9, 2020

CVE Published

via OSV·07:15 PM

Data Sourced

via OSV·07:15 PM

DescriptionSeverity

Frequently Asked Questions

Which applications are realistically exposed to this issue?

Applications using Hermes are exposed only if they permit evaluation of untrusted JavaScript. Most React Native applications are therefore not affected.

What does an attacker need to exploit the vulnerability?

An attacker needs a way to supply crafted JavaScript that the application will evaluate. No privileges or user interaction are required according to the provided vector, but exploitation has high attack complexity.

What is the impact if exploitation succeeds?

Successful exploitation can cause a denial of service and may potentially lead to remote code execution. Confidentiality, integrity, and availability are all rated high in the provided severity vector.

How can I determine whether my Hermes version is affected?

Hermes versions prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 are affected. Compare the Hermes source revision in use with that commit.

GHSA-gmpm-xp43-f7g6: High severity Facebook Hermes vulnerability

Affected Software

Event History

Frequently Asked Questions

Which applications are realistically exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the impact if exploitation succeeds?

How can I determine whether my Hermes version is affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are realistically exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the impact if exploitation succeeds?

How can I determine whether my Hermes version is affected?