CVE-2020-1918

In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca	Patch Third Party Advisory
https://hhvm.com/blog/2021/02/25/security-update.html	Release Notes Vendor Advisory
https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca	Patch Third Party Advisory
https://hhvm.com/blog/2021/02/25/security-update.html	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:facebook:hhvm::::::::
	cpe:2.3:a:facebook:hhvm::::::::
	cpe:2.3:a:facebook:hhvm::::::::
	cpe:2.3:a:facebook:hhvm:4.94.0:::::::*
	cpe:2.3:a:facebook:hhvm:4.95.0:::::::*
	cpe:2.3:a:facebook:hhvm:4.96.0:::::::*
	cpe:2.3:a:facebook:hhvm:4.97.0:::::::*
	cpe:2.3:a:facebook:hhvm:4.98.0:::::::*

History

No history.

Information

Published : 2021-03-10 16:15

Updated : 2024-11-21 05:11

NVD link : CVE-2020-1918

Mitre link : CVE-2020-1918

CVE.ORG link : CVE-2020-1918

JSON object : View

Products Affected

facebook

hhvm

CWE

CWE-127

Buffer Under-read

CWE-125

Out-of-bounds Read

{"id": "CVE-2020-1918", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-03-10T16:15:14.377", "references": [{"url": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca", "tags": ["Patch", "Third Party Advisory"], "source": "cve-assign@fb.com"}, {"url": "https://hhvm.com/blog/2021/02/25/security-update.html", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve-assign@fb.com"}, {"url": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://hhvm.com/blog/2021/02/25/security-update.html", "tags": ["Release Notes", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve-assign@fb.com", "description": [{"lang": "en", "value": "CWE-127"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0."}, {"lang": "es", "value": "Las operaciones de archivos en memoria (es decir, usando fopen en un URI de datos) no restringieron apropiadamente la b\u00fasqueda negativa, permitiendo la lectura de la memoria antes del b\u00fafer en memoria. Este problema afecta HHVM versiones anteriores a 4.56.3, todas las versiones entre 4.57.0 y 4.80.1, todas las versiones entre 4.81.0 y 4.93.1 y las versiones 4.94.0, 4.95.0, 4.96.0, 4.97.0 , 4.98.0"}], "lastModified": "2024-11-21T05:11:36.647", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "069C0B7D-5233-4EFF-BBA7-8B84D9227044", "versionEndExcluding": "4.56.3"}, {"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59DAD37C-9F51-4BE3-B045-537CA259F7F7", "versionEndExcluding": "4.80.2", "versionStartIncluding": "4.57.0"}, {"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B78720F-AA79-459F-A66C-5C4D67D7EE31", "versionEndExcluding": "4.93.2", "versionStartIncluding": "4.81.0"}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.94.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C4B9A3C-6A5A-45C4-A490-C13CF6D6A867"}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.95.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18D33DC0-E6A7-4DC6-8E9A-2B85842EC21B"}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.96.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0B9078D-3C25-45B2-B5F2-59585A47BACB"}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.97.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B8F5C11-8610-4099-8A45-E6241F3D24E0"}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.98.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47FF13C3-19DC-4F53-BF9D-38AC89D647D5"}], "operator": "OR"}]}], "sourceIdentifier": "cve-assign@fb.com"}