CVE-2023-24833: 
NixOS vulnerability analysis and mitigation

A use-after-free vulnerability (CVE-2023-24833) was discovered in the BigIntPrimitive addition functionality of Facebook's Hermes JavaScript engine prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80. The vulnerability could potentially allow attackers to leak raw data from the Hermes VM's heap. Importantly, this vulnerability is only exploitable in scenarios where Hermes is used to execute untrusted JavaScript, meaning most React Native applications are not affected (NVD).

The vulnerability is classified as CWE-416 (Use After Free) and has received a CVSS v3.1 Base Score of 7.5 HIGH with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The issue specifically occurs in the BigIntPrimitive addition operation, where memory could be accessed after it has been freed, potentially exposing heap data (NVD).

The vulnerability could allow an attacker to leak raw data from the Hermes VM's heap, potentially exposing sensitive information. However, the impact is limited to environments where Hermes executes untrusted JavaScript code (NVD).

The vulnerability has been fixed in commit a6dcafe6ded8e61658b40f5699878cd19a481f80. Users should update their Hermes installation to a version that includes this fix (GitHub Commit).