CVE-2020-1898

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-1898

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-1898.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2020-1898

Downstream

UBUNTU-CVE-2020-1898

Published

2021-03-11T01:15:14Z

Modified

2026-02-24T11:34:38Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.

References

Affected packages

Git / github.com/facebook/hhvm

Affected ranges

Type: GIT
Repo: https://github.com/facebook/hhvm
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

1746dfb11fc0048366f34669e74318b8278a684c

Introduced

8df1dd7ead93f50388145dd8d7734a69204b50a7

Fixed

55dc2e1650c1e79e67b7f0ef20e51cd2d504a4bb

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-1898.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "91487532972145899339859786532574555263",
                "326407928188406100671830618769666613359",
                "21551178943104615310045052536714520650",
                "102643094137829386333481076476762460619",
                "53700757438239126383670650319917108424",
                "51500582980409683476804170736651155826",
                "156139227791915618986343167466951799836",
                "205429400389998191863297352820906755441",
                "170075102244105141743887749498636423900"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-1898-01d70c0b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "target": {
            "file": "hphp/runtime/ext/fb/VariantController.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "270737160550213031684840760497248981145",
            "length": 280
        },
        "id": "CVE-2020-1898-0a324714",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "target": {
            "file": "hphp/runtime/ext/fb/ext_fb.cpp",
            "function": "fb_compact_unserialize"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "271790096561396052972573032767504935933",
                "9777719731318520793473962057681738798",
                "61330576844675855404494413271248799124",
                "148174822824141929193172826518108165976",
                "328166032695495337147219091976196694868",
                "214349395177784171051225336605108284220",
                "82203661883655628963475664907581886558",
                "196692206186613515479464340605539317323",
                "263617574364114813576776252851971277771"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-1898-434d5d61",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "target": {
            "file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "271762000487680987672107141546529577534",
            "length": 2764
        },
        "id": "CVE-2020-1898-476b11cb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "target": {
            "file": "hphp/runtime/ext/fb/ext_fb.cpp",
            "function": "fb_compact_unserialize_from_buffer"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "131179548999697731911174089316538092118",
            "length": 249
        },
        "id": "CVE-2020-1898-4b6aa8d1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "target": {
            "file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h",
            "function": "unserializeSet"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "181097208751375604965391235137227738901",
                "121698461318138829929899400579623271629",
                "135429370249437301008081810350940665424",
                "82830804432312628537095303834045631424",
                "211681232477740050467309956442190407689",
                "75042782117546863220999624039775972463",
                "305295146125328853423239815673352858386",
                "210021830632294832939226366541382590488",
                "95166611366815647396683735030895853612",
                "14696346859648069683903721257579375032",
                "204337556357967730450398344932202417421",
                "2163819038607280028979468262770280214",
                "250004932297632704380691985619804240173",
                "232600499681413757795049259759294775028",
                "306254961887074926476221494525247508884",
                "148727549268937441199599944718934469927",
                "144204313731998566398968955957564823409",
                "149744699588593285435672443775513587895",
                "175269912427601477650680453467816310439",
                "3421995533911580137166964287704163988",
                "281233161262593976314108105375163440949",
                "196704612081951055010595689762200058664",
                "339272939625009796129722680277925814069",
                "336901554468839498434373195411458189813",
                "316586586402976138935182021226085738937",
                "272483809826078039096693387273673111235",
                "67381580523396586748313209181317703136",
                "99416485322904319296561357989084698307",
                "90078555816722039571428649786829680225",
                "79842855803770429953299674130892450781",
                "31768561387076061940935759255384140469",
                "76966900588068684686280736706371855979",
                "316586586402976138935182021226085738937",
                "272483809826078039096693387273673111235",
                "67381580523396586748313209181317703136",
                "99416485322904319296561357989084698307",
                "34488496411511293633949836587695075141",
                "263117713334405570814752022705720519454",
                "199210392761886388648445153050430910664",
                "90707207527845928145103593251122919086",
                "20070347726977164041672427603721609124",
                "54565153198004311721761104482579936494",
                "139384008962080267268602386710099234271",
                "136135124634485320899446060054901900310",
                "289002659891145344022660396593862677384",
                "48619848544934364128056366835792962591",
                "17399270253366887314832616289718845033",
                "85530110898555858096741888130966498537",
                "157592902291414109913674787743122528163",
                "131813258107557863092345723158974952640",
                "136990148100903220024894579152205620960",
                "325539388195157626135104758799847475932",
                "305506700244020877028419029244522423197",
                "271366903355991008841625501196561127224",
                "87533374115222047841924654782970141293",
                "71576062193290989306630992866321551834",
                "237152297563026333202164852481578788192",
                "79142347360811686808639275467142433923",
                "237469874781761932968372514611900243207",
                "35894163888992830136615593610239932676"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-1898-77e235e3",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "target": {
            "file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "331473762518125757472384839031571060902",
                "4158620335537989919269120992316136210",
                "37536044244405383633242229082848527784",
                "140335216194151808759673220052749435881"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-1898-b7606651",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/facebook/hhvm/commit/55dc2e1650c1e79e67b7f0ef20e51cd2d504a4bb",
        "target": {
            "file": "hphp/runtime/version.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "145715691786455768944710079437504065661",
            "length": 912
        },
        "id": "CVE-2020-1898-c1ac316e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "target": {
            "file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h",
            "function": "unserializeThing"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "321209806354837655737085289434882826264",
            "length": 534
        },
        "id": "CVE-2020-1898-ccaf80e7",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "target": {
            "file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h",
            "function": "unserializeMap"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "77006485962835594863492230187087547999",
                "123957483544480932709462742203186491198",
                "324681381068544546520157064078432699624",
                "271967712181457776094316578430023955513",
                "35746439978163504071255577375952994696",
                "111701038126874625709433477144313928043",
                "108014145752157512970262006775223792028",
                "280451824540892538894098383718527695398",
                "320881997547167147634222381860457807325",
                "72015313253364208385273246189682791222",
                "194135605952048905490590313043815329918",
                "240497766763099138711501000616704534478",
                "86388656772682628234950305282997416734",
                "72015313253364208385273246189682791222",
                "194135605952048905490590313043815329918",
                "292435924164227485136877448263016733147",
                "278787093222326728305751580044975795474",
                "84139057522681045445478782799070479822",
                "269264687466355196920710521358068180660",
                "241969532403504386394671267598711269430",
                "303070558977685776563107764204445381952",
                "315109574514569473482783075745242172394",
                "4832331348182810375331403790253801695",
                "214966448798573362370817321954941242487",
                "340026193505294365835262781562179029586",
                "284307659605833258428869604414483006252",
                "184991282801291342908007206010620625537",
                "318734695729083989957630994407767660060",
                "259743913818355546975421964218325780269",
                "84538782393050635331448289889279151247",
                "301644608005518607027712444785770546991",
                "89648503310483090253605690973090250947"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2020-1898-cf852ae4",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "target": {
            "file": "hphp/runtime/ext/fb/ext_fb.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "283275413755843508387453944612336227178",
            "length": 86
        },
        "id": "CVE-2020-1898-d4e66146",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "target": {
            "file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h",
            "function": "unserialize"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "151197539678440144023640981284665104395",
            "length": 240
        },
        "id": "CVE-2020-1898-d9284bff",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "target": {
            "file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h",
            "function": "unserializeVector"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "328503010626063701618965234357099058815",
            "length": 255
        },
        "id": "CVE-2020-1898-e7632df2",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "target": {
            "file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h",
            "function": "unserializeList"
        }
    }
]