String Termination Flaw in Facebook HipHop Virtual Machine

CVE-2014-6229

What is CVE-2014-6229?

The HashContext class in Facebook's HipHop Virtual Machine (HHVM) prior to version 3.3.0 contains a flaw where it improperly assumes that certain key strings are properly terminated with a null character ('\0'). This oversight enables remote attackers to read sensitive information by manipulating string data, leading to potential exposure beyond the intended limit. Additionally, this vulnerability can be exploited to undermine cryptographic protections by allowing attackers to truncate strings containing embedded null characters, thereby exposing internal data handling weaknesses.

References