Heap-based buffer overflow in Meta HHVM
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.
Summary
Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p). This happens if the parameters are configurable by an attacker for instance by providing the output of scrypt_enc() in a context where Hack/PHP code would attempt to verify it by re-running scrypt_enc() with the same parameters. This could result in information disclosure, memory being overwriten or crashes of the HHVM process. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Meta | HHVM | 4.8.1; 4.8.0; 4.7.1; 4.7.0; 4.6.1; 4.6.0; 4.5.1; 4.5.0; 4.4.1; 4.4.0; 4.3.1; 4.0.0 and later; 3.30.6; up to 3.30.5 | — | No fix listed | CNA |
- HHVM VendorMeta Affected 4.8.1; 4.8.0; 4.7.1; 4.7.0; 4.6.1; 4.6.0; 4.5.1; 4.5.0; 4.4.1; 4.4.0; 4.3.1; 4.0.0 and later; 3.30.6; up to 3.30.5 Fixed in — No fix listed CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:facebook:hiphop_virtual_machine:*:*:*:*:*:*:*:* | up to 3.30.5; 4.0.0 – 4.0.4 | Vulnerable | Meta |
| cpe:2.3:a:facebook:hiphop_virtual_machine:4.1.0:*:*:*:*:*:*:* | 4.1.0 | Vulnerable | Meta |
| cpe:2.3:a:facebook:hiphop_virtual_machine:4.2.0:*:*:*:*:*:*:* | 4.2.0 | Vulnerable | Meta |
| cpe:2.3:a:facebook:hiphop_virtual_machine:4.3.0:*:*:*:*:*:*:* | 4.3.0 | Vulnerable | Meta |
| cpe:2.3:a:facebook:hiphop_virtual_machine:4.4.0:*:*:*:*:*:*:* | 4.4.0 | Vulnerable | Meta |
| cpe:2.3:a:facebook:hiphop_virtual_machine:4.5.0:*:*:*:*:*:*:* | 4.5.0 | Vulnerable | Meta |
| cpe:2.3:a:facebook:hiphop_virtual_machine:4.6.0:*:*:*:*:*:*:* | 4.6.0 | Vulnerable | Meta |
| cpe:2.3:a:facebook:hiphop_virtual_machine:4.7.0:*:*:*:*:*:*:* | 4.7.0 | Vulnerable | Meta |
| cpe:2.3:a:facebook:hiphop_virtual_machine:4.8.0:*:*:*:*:*:*:* | 4.8.0 | Vulnerable | Meta |
- cpe:2.3:a:facebook:hiphop_virtual_machine:*:*:*:*:*:*:*:* Versions up to 3.30.5; 4.0.0 – 4.0.4 Vulnerable ·Meta
- cpe:2.3:a:facebook:hiphop_virtual_machine:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Meta
- cpe:2.3:a:facebook:hiphop_virtual_machine:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Meta
- cpe:2.3:a:facebook:hiphop_virtual_machine:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·Meta
- cpe:2.3:a:facebook:hiphop_virtual_machine:4.4.0:*:*:*:*:*:*:* Versions 4.4.0 Vulnerable ·Meta
- cpe:2.3:a:facebook:hiphop_virtual_machine:4.5.0:*:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·Meta
- cpe:2.3:a:facebook:hiphop_virtual_machine:4.6.0:*:*:*:*:*:*:* Versions 4.6.0 Vulnerable ·Meta
- cpe:2.3:a:facebook:hiphop_virtual_machine:4.7.0:*:*:*:*:*:*:* Versions 4.7.0 Vulnerable ·Meta
- cpe:2.3:a:facebook:hiphop_virtual_machine:4.8.0:*:*:*:*:*:*:* Versions 4.8.0 Vulnerable ·Meta
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-3570
- 2026-10-03 Alias added: GHSA-4335-6g7p-5556
References
More Meta Hiphop Virtual Machine vulnerabilities
- TI-2014-01747 CRLF injection vulnerability in the LightProcess protocol implementation in… CVSS 2.0HIGH 7.5
- TI-2014-05126 Integer overflow in the string_chunk_split function in hphp/runtime/base/zend-string.cpp… CVSS 2.0HIGH 7.5
- TI-2014-01748 Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group… CVSS 2.0MEDIUM 5.0
- TI-2014-05127 The HashContext class in hphp/runtime/ext/ext_hash.cpp in Facebook HipHop Virtual Machine… CVSS 2.0MEDIUM 5.0
- TI-2014-04389 The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook… CVSS 2.0MEDIUM 5.0
- TI-2014-07899 Cross-site scripting (XSS) vulnerability in the WddxPacket::recursiveAddVar function in… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2019-3570 · CVE Program
- CVE-2019-3570 · NVD
- FIRST EPSS
- GHSA-4335-6g7p-5556 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences