The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
[
{
"target": {
"file": "hphp/runtime/ext/fb/VariantController.h"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2020-1898-01d70c0b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"91487532972145899339859786532574555263",
"326407928188406100671830618769666613359",
"21551178943104615310045052536714520650",
"102643094137829386333481076476762460619",
"53700757438239126383670650319917108424",
"51500582980409683476804170736651155826",
"156139227791915618986343167466951799836",
"205429400389998191863297352820906755441",
"170075102244105141743887749498636423900"
]
}
},
{
"target": {
"function": "fb_compact_unserialize",
"file": "hphp/runtime/ext/fb/ext_fb.cpp"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2020-1898-0a324714",
"digest": {
"function_hash": "270737160550213031684840760497248981145",
"length": 280.0
}
},
{
"target": {
"file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize.h"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2020-1898-434d5d61",
"digest": {
"threshold": 0.9,
"line_hashes": [
"271790096561396052972573032767504935933",
"9777719731318520793473962057681738798",
"61330576844675855404494413271248799124",
"148174822824141929193172826518108165976",
"328166032695495337147219091976196694868",
"214349395177784171051225336605108284220",
"82203661883655628963475664907581886558",
"196692206186613515479464340605539317323",
"263617574364114813576776252851971277771"
]
}
},
{
"target": {
"function": "fb_compact_unserialize_from_buffer",
"file": "hphp/runtime/ext/fb/ext_fb.cpp"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2020-1898-476b11cb",
"digest": {
"function_hash": "271762000487680987672107141546529577534",
"length": 2764.0
}
},
{
"target": {
"function": "unserializeSet",
"file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2020-1898-4b6aa8d1",
"digest": {
"function_hash": "131179548999697731911174089316538092118",
"length": 249.0
}
},
{
"target": {
"file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2020-1898-77e235e3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"181097208751375604965391235137227738901",
"121698461318138829929899400579623271629",
"135429370249437301008081810350940665424",
"82830804432312628537095303834045631424",
"211681232477740050467309956442190407689",
"75042782117546863220999624039775972463",
"305295146125328853423239815673352858386",
"210021830632294832939226366541382590488",
"95166611366815647396683735030895853612",
"14696346859648069683903721257579375032",
"204337556357967730450398344932202417421",
"2163819038607280028979468262770280214",
"250004932297632704380691985619804240173",
"232600499681413757795049259759294775028",
"306254961887074926476221494525247508884",
"148727549268937441199599944718934469927",
"144204313731998566398968955957564823409",
"149744699588593285435672443775513587895",
"175269912427601477650680453467816310439",
"3421995533911580137166964287704163988",
"281233161262593976314108105375163440949",
"196704612081951055010595689762200058664",
"339272939625009796129722680277925814069",
"336901554468839498434373195411458189813",
"316586586402976138935182021226085738937",
"272483809826078039096693387273673111235",
"67381580523396586748313209181317703136",
"99416485322904319296561357989084698307",
"90078555816722039571428649786829680225",
"79842855803770429953299674130892450781",
"31768561387076061940935759255384140469",
"76966900588068684686280736706371855979",
"316586586402976138935182021226085738937",
"272483809826078039096693387273673111235",
"67381580523396586748313209181317703136",
"99416485322904319296561357989084698307",
"34488496411511293633949836587695075141",
"263117713334405570814752022705720519454",
"199210392761886388648445153050430910664",
"90707207527845928145103593251122919086",
"20070347726977164041672427603721609124",
"54565153198004311721761104482579936494",
"139384008962080267268602386710099234271",
"136135124634485320899446060054901900310",
"289002659891145344022660396593862677384",
"48619848544934364128056366835792962591",
"17399270253366887314832616289718845033",
"85530110898555858096741888130966498537",
"157592902291414109913674787743122528163",
"131813258107557863092345723158974952640",
"136990148100903220024894579152205620960",
"325539388195157626135104758799847475932",
"305506700244020877028419029244522423197",
"271366903355991008841625501196561127224",
"87533374115222047841924654782970141293",
"71576062193290989306630992866321551834",
"237152297563026333202164852481578788192",
"79142347360811686808639275467142433923",
"237469874781761932968372514611900243207",
"35894163888992830136615593610239932676"
]
}
},
{
"target": {
"function": "unserializeThing",
"file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2020-1898-c1ac316e",
"digest": {
"function_hash": "145715691786455768944710079437504065661",
"length": 912.0
}
},
{
"target": {
"function": "unserializeMap",
"file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2020-1898-ccaf80e7",
"digest": {
"function_hash": "321209806354837655737085289434882826264",
"length": 534.0
}
},
{
"target": {
"file": "hphp/runtime/ext/fb/ext_fb.cpp"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2020-1898-cf852ae4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"77006485962835594863492230187087547999",
"123957483544480932709462742203186491198",
"324681381068544546520157064078432699624",
"271967712181457776094316578430023955513",
"35746439978163504071255577375952994696",
"111701038126874625709433477144313928043",
"108014145752157512970262006775223792028",
"280451824540892538894098383718527695398",
"320881997547167147634222381860457807325",
"72015313253364208385273246189682791222",
"194135605952048905490590313043815329918",
"240497766763099138711501000616704534478",
"86388656772682628234950305282997416734",
"72015313253364208385273246189682791222",
"194135605952048905490590313043815329918",
"292435924164227485136877448263016733147",
"278787093222326728305751580044975795474",
"84139057522681045445478782799070479822",
"269264687466355196920710521358068180660",
"241969532403504386394671267598711269430",
"303070558977685776563107764204445381952",
"315109574514569473482783075745242172394",
"4832331348182810375331403790253801695",
"214966448798573362370817321954941242487",
"340026193505294365835262781562179029586",
"284307659605833258428869604414483006252",
"184991282801291342908007206010620625537",
"318734695729083989957630994407767660060",
"259743913818355546975421964218325780269",
"84538782393050635331448289889279151247",
"301644608005518607027712444785770546991",
"89648503310483090253605690973090250947"
]
}
},
{
"target": {
"function": "unserialize",
"file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2020-1898-d4e66146",
"digest": {
"function_hash": "283275413755843508387453944612336227178",
"length": 86.0
}
},
{
"target": {
"function": "unserializeVector",
"file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2020-1898-d9284bff",
"digest": {
"function_hash": "151197539678440144023640981284665104395",
"length": 240.0
}
},
{
"target": {
"function": "unserializeList",
"file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h"
},
"source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2020-1898-e7632df2",
"digest": {
"function_hash": "328503010626063701618965234357099058815",
"length": 255.0
}
}
]