Skip to content
Sign in
Not rated

CVE-2021-24036 Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds…

Description

Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1.

Affected products and versions

Product Affected versions Fixed in
folly 2021.07 earliest → < 2021.07.22.00 2021.07.22.00
HHVM 4.118 4.118.0 → < 4.118.2 4.118.2
HHVM 4.117.0 4.117.1
HHVM 4.116.0 4.116.1
HHVM 4.115.0 4.115.1
HHVM 4.114.0 4.114.1
HHVM 4.113.0 4.113.1
HHVM 4.102 4.102.0 → < 4.102.2 4.102.2
HHVM 4.81 4.81.0 → latest No fix stated
Show the other branch
Product Affected versions Fixed in
HHVM 4.80 earliest → < 4.80.5 4.80.5

Other CVEs of folly

The 3 CVEs of folly →
CVE-2019-11934 Improper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket Not rated CVE-2018-6337 folly::secureRandom will re-use a buffer between parent and child processes when fork() is called 7.5 High
Track this CVE