CVE-2023-24833
📋 TL;DR
CVE-2023-24833 is a use-after-free vulnerability in Hermes JavaScript engine's BigIntPrimitive addition that allows attackers to leak raw heap data from the Hermes VM. This primarily affects applications using Hermes to execute untrusted JavaScript code. Most React Native applications are not affected since they typically don't execute untrusted JavaScript.
💻 Affected Systems
- Facebook Hermes JavaScript engine
📦 What is this software?
Hermes by Facebook
⚠️ Risk & Real-World Impact
Worst Case
Attackers could leak sensitive data from the Hermes VM heap, potentially exposing application secrets, cryptographic keys, or other sensitive information in memory.
Likely Case
Information disclosure through heap memory leaks when processing malicious JavaScript in affected Hermes deployments.
If Mitigated
No impact if Hermes is not used to execute untrusted JavaScript or if the patch is applied.
🎯 Exploit Status
Exploitation requires the ability to execute JavaScript in the Hermes VM context.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Hermes commit a6dcafe6ded8e61658b40f5699878cd19a481f80 and later
Vendor Advisory: https://www.facebook.com/security/advisories/cve-2023-24833
Restart Required: Yes
Instructions:
1. Update Hermes to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 or later. 2. Rebuild and redeploy applications using Hermes. 3. Restart affected services.
🔧 Temporary Workarounds
Disable untrusted JavaScript execution
allPrevent execution of untrusted JavaScript in Hermes VM
🧯 If You Can't Patch
- Isolate Hermes instances that process untrusted JavaScript
- Implement strict input validation and sandboxing for JavaScript execution
🔍 How to Verify
Check if Vulnerable:
Check Hermes version/commit hash against vulnerable range (pre-commit a6dcafe6ded8e61658b40f5699878cd19a481f80)Check Version:
Check build configuration or package manager for Hermes versionVerify Fix Applied:
Verify Hermes is at commit a6dcafe6ded8e61658b40f5699878cd19a481f80 or later📡 Detection & Monitoring
Log Indicators:
- Unexpected memory access patterns
- Hermes process crashes or abnormal behavior
Network Indicators:
- Unusual outbound data transfers from Hermes processes
SIEM Query:
Process:hermes AND (EventID:1000 OR Memory:AccessViolation)