CVE-2021-24036: 
NixOS vulnerability analysis and mitigation

CVE-2021-24036 is a security vulnerability discovered in Facebook's Folly library and HHVM that involves an integer overflow issue. The vulnerability occurs when passing an attacker-controlled size when creating an IOBuf, which could lead to an out-of-bounds write on the heap with the possibility of remote code execution. This vulnerability affects Folly versions prior to v2021.07.22.00 and HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1 (CVE Mitre).

The vulnerability stems from insufficient bounds checking in the IOBuf class implementation. When creating an IOBuf with an attacker-controlled size parameter, an integer overflow could occur, leading to an out-of-bounds write on the heap. The fix involved adding additional overflow checks to IOBuf and implementing a maximum size limit (kMaxIOBufSize) set to half of the maximum integer value (GitHub Commit).

The vulnerability could allow attackers to execute arbitrary code remotely through specially crafted input that triggers the integer overflow condition. This poses a significant risk as it could lead to complete system compromise in affected applications using the vulnerable versions of Folly or HHVM (HHVM Blog).

The vulnerability requires an attacker to be able to control the size parameter when creating an IOBuf object. While specific details about exploits in the wild are not publicly available, the potential for remote code execution makes this a critical security issue (CVE Mitre).

Users should upgrade to Folly version v2021.07.22.00 or later, or upgrade HHVM to version 4.80.5, 4.102.2, 4.113.1, 4.114.1, 4.115.1, 4.116.1, 4.117.1, or 4.118.2. For Debian 10 Buster and Ubuntu 18.04 Bionic users, versions 4.80.6 and 4.102.3 are available with updated build system compatibility (HHVM Blog).