CVE-2020-1898: 
HHVM vulnerability analysis and mitigation

CVE-2020-1898 affects the fb_unserialize function in HHVM (HipHop Virtual Machine), where the absence of a depth limit for nested deserialization could lead to security issues. The vulnerability was discovered in December 2019 and affects HHVM versions prior to v4.32.3, between versions 4.33.0 and 4.56.0, as well as versions 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, and 4.62.0 (NIST NVD, MITRE CVE).

The vulnerability exists in the fb_unserialize function which failed to implement a depth limit for nested deserialization operations. This oversight allows maliciously crafted strings to cause unlimited recursion during the deserialization process. The CVSS v3.1 base score is 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NIST NVD).

When exploited, this vulnerability can lead to stack exhaustion through recursive deserialization, potentially causing a denial of service condition in the affected HHVM installation (NIST NVD).

The vulnerability can be triggered by providing a maliciously constructed string to the fb_unserialize function, causing it to recurse beyond safe limits. The attack vector is network-accessible with low attack complexity and requires no privileges or user interaction (NIST NVD).

The vulnerability has been patched in HHVM version 4.32.3 and subsequent releases. Users should upgrade to one of the following fixed versions: 4.32.3, 4.56.1, 4.57.1, 4.58.2, 4.59.1, 4.60.1, 4.61.1, 4.62.1, or 4.64.0 (HHVM Blog).