CVE-2021-24044 Access of Resource Using Incompatible Type in Hermes
A type confusion vulnerability in the Hermes JavaScript engine allows attackers to cause a segmentation fault and potentially execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-24044?
CVE-2021-24044 is a critical memory corruption vulnerability in Facebook Hermes, published on 15 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a consequence of type confusion error, with a low chance of RCE. This issue affects Hermes versions prior to v0.10.0.
Weakness: CWE-843
Which versions are affected by CVE-2021-24044?
2 open source packages ship an affected version, including hermes-engine. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hermes-engine npm | All versions | 0.10.0 |
hermes-engine npm | All versions | 0.10.0 |
Products include Facebook Hermes.
How do I fix CVE-2021-24044?
Upgrade hermes-engine to 0.10.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-24044 being exploited?
There is no known exploitation of CVE-2021-24044 in the wild and no public exploit code.
Other vulnerabilities in Facebook Hermes
Sources
Also known as GHSA-7mhc-prgv-r3q4.