CVE-2021-24036
📋 TL;DR
This CVE describes an integer overflow vulnerability in Facebook's folly library that affects HHVM. An attacker can pass a controlled size when creating an IOBuf, causing heap corruption that could lead to remote code execution. This affects specific versions of folly and HHVM as detailed in the advisory.
💻 Affected Systems
- folly
- HHVM
📦 What is this software?
Folly by Facebook
Hhvm by Facebook
Hhvm by Facebook
Hhvm by Facebook
Hhvm by Facebook
Hhvm by Facebook
Hhvm by Facebook
Hhvm by Facebook
Hhvm by Facebook
Hhvm by Facebook
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with full system compromise, allowing attacker to execute arbitrary code on affected systems.
Likely Case
Denial of service through application crashes or potential remote code execution in vulnerable configurations.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are applied, though risk remains significant.
🎯 Exploit Status
The vulnerability requires attacker-controlled input but has high CVSS score indicating significant exploit potential.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: folly v2021.07.22.00; HHVM: 4.80.5, 4.102.2, 4.113.1, 4.119.0
Vendor Advisory: https://www.facebook.com/security/advisories/cve-2021-24036
Restart Required: Yes
Instructions:
1. Update folly to v2021.07.22.00 or later. 2. Update HHVM to patched versions: 4.80.5, 4.102.2, 4.113.1, or 4.119.0. 3. Restart affected services after patching.
🔧 Temporary Workarounds
Input validation
allImplement strict input validation for size parameters passed to IOBuf creation functions
🧯 If You Can't Patch
- Implement network segmentation to isolate affected systems from untrusted networks
- Apply strict input validation and sanitization for all user-controlled parameters
🔍 How to Verify
Check if Vulnerable:
Check folly version: grep -r 'FOLLY_VERSION' /path/to/folly/ or check HHVM version: hhvm --versionCheck Version:
hhvm --versionVerify Fix Applied:
Verify installed versions: folly >= v2021.07.22.00 and HHVM version not in affected ranges📡 Detection & Monitoring
Log Indicators:
- Application crashes
- Memory corruption errors
- Unexpected process termination
Network Indicators:
- Unusual network traffic to HHVM services
- Exploit attempts targeting specific endpoints
SIEM Query:
source="*hhvm*" AND (event="crash" OR event="segfault" OR event="memory_error")🔗 References
- https://github.com/facebook/folly/commit/4f304af1411e68851bdd00ef6140e9de4616f7d3
- https://hhvm.com/blog/2021/07/20/security-update.html
- https://www.facebook.com/security/advisories/cve-2021-24036
- https://github.com/facebook/folly/commit/4f304af1411e68851bdd00ef6140e9de4616f7d3
- https://hhvm.com/blog/2021/07/20/security-update.html
- https://www.facebook.com/security/advisories/cve-2021-24036
