CVE-2020-1900: 
HHVM vulnerability analysis and mitigation

CVE-2020-1900 is a vulnerability in HHVM (HipHop Virtual Machine) related to object unserialization with dynamic properties. The issue affects HHVM versions prior to v4.32.3, between versions 4.33.0 and 4.56.0, and versions 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, and 4.62.0. The vulnerability was discovered in 2019 and publicly disclosed in June 2020 (NIST NVD).

When unserializing an object with dynamic properties, HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it. If this pre-reservation is not performed, the array might resize, which could invalidate previously stored references. This vulnerability occurs because the pre-reservation was not happening in affected versions. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NIST NVD).

The vulnerability could lead to a use-after-free condition during object unserialization, potentially resulting in arbitrary code execution, information disclosure, or system crashes. The high CVSS score indicates that this vulnerability could have severe consequences if exploited (NIST NVD).

The vulnerability requires no special privileges or user interaction to exploit, and can be triggered through network access. The attack complexity is considered low, making it relatively straightforward to exploit if unpatched (NIST NVD).

The vulnerability has been fixed in HHVM version 4.32.3 and versions 4.56.1 and above. Users are advised to upgrade to these patched versions to protect against this vulnerability. The fix involves implementing proper pre-reservation of dynamic property arrays during object unserialization (HHVM Blog, GitHub Patch).