CVE-2016-1000005
📋 TL;DR
This CVE involves a type confusion vulnerability in HHVM's mcrypt_get_block_size function where the 'module' parameter wasn't properly validated as a string. Attackers could exploit this to potentially execute arbitrary code or cause denial of service. Affected are HHVM installations in specific version ranges prior to the fix.
💻 Affected Systems
- HHVM (HipHop Virtual Machine)
📦 What is this software?
Hhvm by Facebook
Hhvm by Facebook
Hhvm by Facebook
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise
Likely Case
Application crash or denial of service
If Mitigated
Limited impact if proper input validation and type checking are implemented
🎯 Exploit Status
Exploitation requires crafting specific input to trigger type confusion
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.9.5, 3.12.4, or 3.14.2 and later
Vendor Advisory: https://www.facebook.com/security/advisories/cve-2016-1000005
Restart Required: Yes
Instructions:
1. Identify current HHVM version. 2. Upgrade to 3.9.5, 3.12.4, or 3.14.2+. 3. Restart HHVM service. 4. Verify the fix is applied.
🔧 Temporary Workarounds
Disable mcrypt extension
allRemove or disable the mcrypt extension if not required
Remove mcrypt.so from HHVM configuration or disable via ini settings
Input validation wrapper
allImplement strict type checking before calling mcrypt_get_block_size
Wrap mcrypt_get_block_size calls with is_string() checks
🧯 If You Can't Patch
- Implement strict input validation for all parameters passed to mcrypt_get_block_size
- Isolate HHVM instances behind firewalls and restrict network access
🔍 How to Verify
Check if Vulnerable:
Check HHVM version with 'hhvm --version' and compare against affected rangesCheck Version:
hhvm --versionVerify Fix Applied:
Verify version is 3.9.5+, 3.12.4+, or 3.14.2+ and test mcrypt_get_block_size with various input types📡 Detection & Monitoring
Log Indicators:
- HHVM crashes, segmentation faults, or abnormal termination logs
Network Indicators:
- Unusual requests to endpoints using mcrypt functions
SIEM Query:
source="hhvm.log" AND ("segmentation fault" OR "type confusion" OR "mcrypt_get_block_size")