CVE-2021-24036

high-risk
Published 2021-07-23

Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1.

Do I need to act?

~
6.2% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (8)

Folly

Affected Vendors

Facebook

References (6)

Patch https://github.com/facebook/folly/commit/4f304af1411e68851bdd00ef6140e9de4616f7d...
Product https://hhvm.com/blog/2021/07/20/security-update.html
Vendor Advisory https://www.facebook.com/security/advisories/cve-2021-24036
Patch https://github.com/facebook/folly/commit/4f304af1411e68851bdd00ef6140e9de4616f7d...
Product https://hhvm.com/blog/2021/07/20/security-update.html
Vendor Advisory https://www.facebook.com/security/advisories/cve-2021-24036
55
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 9/34 · Low
Exposure 14/34 · Moderate