CVE Vulnerabilities

CVE-2020-1898

Uncontrolled Recursion

Published: Mar 11, 2021 | Modified: Mar 17, 2021
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.

Weakness

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected Software

Name Vendor Start Version End Version
Hhvm Facebook * 4.32.3 (excluding)
Hhvm Facebook 4.33.0 (including) 4.56.1 (excluding)
Hhvm Facebook 4.57.0 (including) 4.57.0 (including)
Hhvm Facebook 4.58.0 (including) 4.58.0 (including)
Hhvm Facebook 4.58.1 (including) 4.58.1 (including)
Hhvm Facebook 4.59.0 (including) 4.59.0 (including)
Hhvm Facebook 4.60.0 (including) 4.60.0 (including)
Hhvm Facebook 4.61.0 (including) 4.61.0 (including)
Hhvm Facebook 4.62.0 (including) 4.62.0 (including)
Hhvm Ubuntu bionic *
Hhvm Ubuntu trusty *
Hhvm Ubuntu xenial *

Potential Mitigations

References