CVE-2019-3570 Memory corruption in HHVM

Critical 9.8 Published 18 Jul 2019 Updated 4 Aug 2024

Attackers can trigger heap corruption in HHVM via crafted scrypt parameters, leading to information disclosure or crashes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-3570?

CVE-2019-3570 is a critical memory corruption vulnerability in Facebook HHVM, published on 18 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p). This happens if the parameters are configurable by an attacker for instance by providing the output of scrypt_enc() in a context where Hack/PHP code would attempt to verify it by re-running scrypt_enc() with the same parameters. This could result in information disclosure, memory being overwriten or crashes of the HHVM process. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.

Weakness: CWE-787, CWE-122

Which versions are affected by CVE-2019-3570?

It affects 1 product.

Products include Facebook Hiphop Virtual Machine.

How do I fix CVE-2019-3570?

No fix has been published for CVE-2019-3570 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2019-3570 being exploited?

There is no known exploitation of CVE-2019-3570 in the wild and no public exploit code.

Sources

Also known as GHSA-4335-6g7p-5556, UBUNTU-CVE-2019-3570.