CVE-2023-24832 Null dereference in Hermes
An attacker can crash the Hermes runtime via null pointer dereference when executing untrusted JavaScript with specific internal configurations enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-24832?
CVE-2023-24832 is a high-severity vulnerability in Facebook Hermes, published on 18 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config option was set to true. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
Weakness: CWE-476
Which versions are affected by CVE-2023-24832?
It affects 1 product.
Products include Facebook Hermes.
How do I fix CVE-2023-24832?
No fix has been published for CVE-2023-24832 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-24832 being exploited?
There is no known exploitation of CVE-2023-24832 in the wild and no public exploit code.
Other vulnerabilities in Facebook Hermes
Sources
Also known as GHSA-5jqp-fwpp-hvwv.