High severity · published Dec 31, 2018
CVE-2018-6337
folly::secureRandom will re-use a buffer between parent and child processes when fork() is called
7.5
CVSS
1.8%
EPSS
No
On KEV
Description
folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Folly · Facebook
2017.12.11.00 through 2018.08.09.00 · source: NVD
HH
Hhvm · Facebook
3.26 before 3.26.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-6337
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-6337
Patch
https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761f
Patch
https://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8
Release Notes
https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.html
More from Folly
9.8
CVE-2021-24036
Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code…
9.8
CVE-2019-11934
Improper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket