CVE-2020-1899: 
HHVM vulnerability analysis and mitigation

CVE-2020-1899 is a vulnerability in HHVM's unserialize() function that was discovered in 2019. The vulnerability allowed arbitrary memory addresses to be accessed as if they were static StringData objects through a type code 'S', which was meant to be supported only for APC serialization. This issue affected multiple versions of HHVM including versions prior to v4.32.3, between versions 4.33.0 and 4.56.0, and specific versions 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, and 4.62.0 (NVD).

The vulnerability stems from the unserialize() function's improper handling of the type code 'S'. The function allowed this type code to be used outside of its intended APC serialization context, enabling arbitrary memory address access. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. It is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-822 (Untrusted Pointer Dereference) (NVD).

The vulnerability allows attackers to access arbitrary memory addresses as if they were static StringData objects, potentially leading to information disclosure. The CVSS score indicates high confidentiality impact but no impact on integrity or availability of the system (NVD).

The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction. This is reflected in the CVSS vector string components: AV:N/AC:L/PR:N/UI:N (NVD).

Facebook released security updates to address this vulnerability. Users should upgrade to one of the following patched versions: 4.32.3, 4.56.1, 4.57.1, 4.58.2, 4.59.1, 4.60.1, 4.61.1, 4.62.1, or 4.64.0 (HHVM Blog).