CVE-2019-11930 Use after free in HHVM

Critical 9.8 Published 4 Dec 2019 Updated 4 Aug 2024

An invalid free in mb_detect_order allows attackers to crash the application or potentially execute remote code in HHVM.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-11930?

CVE-2019-11930 is a critical use after free vulnerability in Facebook HHVM, published on 4 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.

Weakness: CWE-763

Which versions are affected by CVE-2019-11930?

It affects 1 product.

Products include Facebook Hhvm.

How do I fix CVE-2019-11930?

No fix has been published for CVE-2019-11930 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2019-11930 being exploited?

There is no known exploitation of CVE-2019-11930 in the wild and no public exploit code.

Sources

Also known as GHSA-5h4f-x39p-f6v8, UBUNTU-CVE-2019-11930.