Arbitrary Memory Access Vulnerability in HHVM by Facebook

CVE-2020-1899

What is CVE-2020-1899?

The vulnerability occurs due to the unserialize() function improperly supporting a type code, 'S', that is intended solely for APC serialization. This flaw enables arbitrary memory addresses to be accessed under the guise of static StringData objects, potentially compromising the security of applications running on HHVM. Affected versions include those prior to 4.32.3 and specific versions between 4.33.0 and 4.62.0. Developers using HHVM should review updates and apply necessary patches to mitigate risks.

References