CVE-2020-1898

Source
https://nvd.nist.gov/vuln/detail/CVE-2020-1898
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-1898.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2020-1898
Downstream
Published
2021-03-11T01:15:14.177Z
Modified
2025-11-14T10:55:45.733347Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.

References

Affected packages

Git / github.com/facebook/hhvm

Affected ranges

Type
GIT
Repo
https://github.com/facebook/hhvm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

HPHP-2.*

HPHP-2.1.0

gcc-4.*

gcc-4.6

nightly-2019.*

nightly-2019.03.28
nightly-2019.03.29
nightly-2019.03.30
nightly-2019.03.31
nightly-2019.04.01
nightly-2019.04.02
nightly-2019.04.03
nightly-2019.04.04
nightly-2019.04.05
nightly-2019.04.06
nightly-2019.04.07
nightly-2019.04.08
nightly-2019.04.09
nightly-2019.04.10
nightly-2019.04.11
nightly-2019.04.12
nightly-2019.04.13
nightly-2019.04.14
nightly-2019.04.15
nightly-2019.04.16
nightly-2019.04.17
nightly-2019.04.18
nightly-2019.04.19
nightly-2019.04.20
nightly-2019.04.21
nightly-2019.04.22
nightly-2019.04.23
nightly-2019.04.24
nightly-2019.04.25
nightly-2019.04.26
nightly-2019.04.27
nightly-2019.04.28
nightly-2019.04.29
nightly-2019.04.30
nightly-2019.05.01
nightly-2019.05.02
nightly-2019.05.03
nightly-2019.05.04
nightly-2019.05.05
nightly-2019.05.06
nightly-2019.05.07
nightly-2019.05.08
nightly-2019.05.09
nightly-2019.05.10
nightly-2019.05.11
nightly-2019.05.12
nightly-2019.05.13
nightly-2019.05.14
nightly-2019.05.15
nightly-2019.05.16
nightly-2019.05.17
nightly-2019.05.18
nightly-2019.05.19
nightly-2019.05.20
nightly-2019.05.21
nightly-2019.05.22
nightly-2019.05.23
nightly-2019.05.24
nightly-2019.05.25
nightly-2019.05.26
nightly-2019.05.27
nightly-2019.05.28
nightly-2019.05.29
nightly-2019.05.30
nightly-2019.05.31
nightly-2019.06.01
nightly-2019.06.02
nightly-2019.06.03
nightly-2019.06.04
nightly-2019.06.05
nightly-2019.06.06
nightly-2019.06.07
nightly-2019.06.08
nightly-2019.06.09
nightly-2019.06.10
nightly-2019.06.11
nightly-2019.06.12
nightly-2019.06.13
nightly-2019.06.14
nightly-2019.06.15
nightly-2019.06.16
nightly-2019.06.17
nightly-2019.06.18
nightly-2019.06.19
nightly-2019.06.20
nightly-2019.06.21
nightly-2019.06.22
nightly-2019.06.23
nightly-2019.06.24
nightly-2019.06.25
nightly-2019.06.26
nightly-2019.06.27
nightly-2019.06.28
nightly-2019.06.29
nightly-2019.06.30
nightly-2019.07.01
nightly-2019.07.02
nightly-2019.07.03
nightly-2019.07.04
nightly-2019.07.05
nightly-2019.07.06
nightly-2019.07.07
nightly-2019.07.08
nightly-2019.07.09
nightly-2019.07.10
nightly-2019.07.11
nightly-2019.07.12
nightly-2019.07.13
nightly-2019.07.14
nightly-2019.07.15
nightly-2019.07.16
nightly-2019.07.17
nightly-2019.07.18
nightly-2019.07.19
nightly-2019.07.20
nightly-2019.07.21
nightly-2019.07.22
nightly-2019.07.23
nightly-2019.07.24
nightly-2019.07.25
nightly-2019.07.26
nightly-2019.07.27
nightly-2019.07.28
nightly-2019.07.29
nightly-2019.07.30
nightly-2019.07.31
nightly-2019.08.01
nightly-2019.08.02
nightly-2019.08.03
nightly-2019.08.04
nightly-2019.08.05
nightly-2019.08.06
nightly-2019.08.07
nightly-2019.08.08
nightly-2019.08.09
nightly-2019.08.10
nightly-2019.08.11
nightly-2019.08.12
nightly-2019.08.13
nightly-2019.08.14
nightly-2019.08.15
nightly-2019.08.16
nightly-2019.08.17
nightly-2019.08.18
nightly-2019.08.19
nightly-2019.08.20
nightly-2019.08.21
nightly-2019.08.22
nightly-2019.08.23
nightly-2019.08.24
nightly-2019.08.25
nightly-2019.08.26
nightly-2019.08.27
nightly-2019.08.28
nightly-2019.08.29
nightly-2019.08.30
nightly-2019.08.31
nightly-2019.09.01
nightly-2019.09.02
nightly-2019.09.03
nightly-2019.09.04
nightly-2019.09.05
nightly-2019.09.06
nightly-2019.09.07
nightly-2019.09.08
nightly-2019.09.09
nightly-2019.09.10
nightly-2019.09.11
nightly-2019.09.12
nightly-2019.09.13
nightly-2019.09.14
nightly-2019.09.15
nightly-2019.09.16
nightly-2019.09.17
nightly-2019.09.18
nightly-2019.09.19
nightly-2019.09.20
nightly-2019.09.21
nightly-2019.09.22
nightly-2019.09.23
nightly-2019.09.24
nightly-2019.09.25
nightly-2019.09.26
nightly-2019.09.27
nightly-2019.09.28
nightly-2019.09.29
nightly-2019.09.30
nightly-2019.10.01
nightly-2019.10.02
nightly-2019.10.03
nightly-2019.10.04
nightly-2019.10.05
nightly-2019.10.06
nightly-2019.10.07
nightly-2019.10.08
nightly-2019.10.09
nightly-2019.10.10
nightly-2019.10.11
nightly-2019.10.12
nightly-2019.10.13
nightly-2019.10.14
nightly-2019.10.15
nightly-2019.10.16
nightly-2019.10.17
nightly-2019.10.18
nightly-2019.10.19
nightly-2019.10.20
nightly-2019.10.21
nightly-2019.10.22
nightly-2019.10.23
nightly-2019.10.24
nightly-2019.10.25
nightly-2019.10.26
nightly-2019.10.27
nightly-2019.10.28
nightly-2019.10.29
nightly-2019.10.30
nightly-2019.10.31
nightly-2019.11.01
nightly-2019.11.02
nightly-2019.11.03
nightly-2019.11.04
nightly-2019.11.05
nightly-2019.11.06
nightly-2019.11.07
nightly-2019.11.08
nightly-2019.11.09
nightly-2019.11.10
nightly-2019.11.11
nightly-2019.11.12
nightly-2019.11.13
nightly-2019.11.14
nightly-2019.11.15
nightly-2019.11.16
nightly-2019.11.17
nightly-2019.11.18
nightly-2019.11.19
nightly-2019.11.20
nightly-2019.11.21
nightly-2019.11.22
nightly-2019.11.23
nightly-2019.11.24
nightly-2019.11.25
nightly-2019.11.26
nightly-2019.11.27
nightly-2019.11.28
nightly-2019.11.29
nightly-2019.11.30
nightly-2019.12.01
nightly-2019.12.02
nightly-2019.12.03
nightly-2019.12.04
nightly-2019.12.05
nightly-2019.12.06
nightly-2019.12.07
nightly-2019.12.08
nightly-2019.12.09
nightly-2019.12.10
nightly-2019.12.11
nightly-2019.12.12
nightly-2019.12.13
nightly-2019.12.14
nightly-2019.12.15
nightly-2019.12.16
nightly-2019.12.17
nightly-2019.12.18
nightly-2019.12.19
nightly-2019.12.20
nightly-2019.12.21
nightly-2019.12.22
nightly-2019.12.23
nightly-2019.12.24
nightly-2019.12.25
nightly-2019.12.26
nightly-2019.12.27
nightly-2019.12.28
nightly-2019.12.29
nightly-2019.12.30
nightly-2019.12.31

nightly-2020.*

nightly-2020.01.01
nightly-2020.01.02
nightly-2020.01.03
nightly-2020.01.04
nightly-2020.01.05
nightly-2020.01.06
nightly-2020.01.07
nightly-2020.01.08
nightly-2020.01.09
nightly-2020.01.10
nightly-2020.01.11
nightly-2020.01.12
nightly-2020.01.13
nightly-2020.01.14
nightly-2020.01.15
nightly-2020.01.16
nightly-2020.01.17
nightly-2020.01.18
nightly-2020.01.19
nightly-2020.01.20
nightly-2020.01.21
nightly-2020.01.22
nightly-2020.01.23
nightly-2020.01.24
nightly-2020.01.25
nightly-2020.01.26
nightly-2020.01.27
nightly-2020.01.28
nightly-2020.01.29
nightly-2020.01.30
nightly-2020.01.31
nightly-2020.02.01
nightly-2020.02.02
nightly-2020.02.03
nightly-2020.02.04
nightly-2020.02.05
nightly-2020.02.06
nightly-2020.02.07
nightly-2020.02.08
nightly-2020.02.09
nightly-2020.02.10
nightly-2020.02.11
nightly-2020.02.12
nightly-2020.02.13
nightly-2020.02.14
nightly-2020.02.15
nightly-2020.02.16
nightly-2020.02.17
nightly-2020.02.18
nightly-2020.02.19
nightly-2020.02.20
nightly-2020.02.21
nightly-2020.02.22
nightly-2020.02.23
nightly-2020.02.24
nightly-2020.02.25
nightly-2020.02.26
nightly-2020.02.27
nightly-2020.02.28
nightly-2020.02.29
nightly-2020.03.01
nightly-2020.03.02
nightly-2020.03.03
nightly-2020.03.04
nightly-2020.03.05
nightly-2020.03.06
nightly-2020.03.07
nightly-2020.03.08
nightly-2020.03.09
nightly-2020.03.10
nightly-2020.03.11
nightly-2020.03.12
nightly-2020.03.13
nightly-2020.03.14
nightly-2020.03.15
nightly-2020.03.16
nightly-2020.03.17
nightly-2020.03.18
nightly-2020.03.19
nightly-2020.03.20
nightly-2020.03.21
nightly-2020.03.22
nightly-2020.03.23
nightly-2020.03.24
nightly-2020.03.25
nightly-2020.03.26
nightly-2020.03.27
nightly-2020.03.28
nightly-2020.03.29
nightly-2020.03.30
nightly-2020.03.31
nightly-2020.04.01
nightly-2020.04.02
nightly-2020.04.03
nightly-2020.04.04
nightly-2020.04.05
nightly-2020.04.06
nightly-2020.04.07
nightly-2020.04.08
nightly-2020.04.09
nightly-2020.04.10
nightly-2020.04.11
nightly-2020.04.12
nightly-2020.04.13
nightly-2020.04.14
nightly-2020.04.15
nightly-2020.04.16
nightly-2020.04.17
nightly-2020.04.18
nightly-2020.04.19
nightly-2020.04.20
nightly-2020.04.21
nightly-2020.04.22
nightly-2020.04.23
nightly-2020.04.24
nightly-2020.04.25
nightly-2020.04.26
nightly-2020.04.27
nightly-2020.04.28
nightly-2020.04.29
nightly-2020.04.30
nightly-2020.05.01
nightly-2020.05.02
nightly-2020.05.03
nightly-2020.05.04
nightly-2020.05.05
nightly-2020.05.06
nightly-2020.05.07
nightly-2020.05.08
nightly-2020.05.09
nightly-2020.05.10
nightly-2020.05.11
nightly-2020.05.12
nightly-2020.05.13
nightly-2020.05.14
nightly-2020.05.15
nightly-2020.05.16
nightly-2020.05.17
nightly-2020.05.18
nightly-2020.05.19
nightly-2020.05.20
nightly-2020.05.21
nightly-2020.05.22
nightly-2020.05.23
nightly-2020.05.24
nightly-2020.05.25
nightly-2020.05.26
nightly-2020.05.27
nightly-2020.05.28
nightly-2020.05.29
nightly-2020.05.30
nightly-2020.05.31
nightly-2020.06.01
nightly-2020.06.02
nightly-2020.06.03
nightly-2020.06.04
nightly-2020.06.05
nightly-2020.06.06
nightly-2020.06.07
nightly-2020.06.08
nightly-2020.06.09
nightly-2020.06.10
nightly-2020.06.11
nightly-2020.06.12
nightly-2020.06.13
nightly-2020.06.14
nightly-2020.06.15
nightly-2020.06.16
nightly-2020.06.17
nightly-2020.06.18
nightly-2020.06.19
nightly-2020.06.20
nightly-2020.06.21
nightly-2020.06.22
nightly-2020.06.23
nightly-2020.06.24
nightly-2020.06.25
nightly-2020.06.26
nightly-2020.06.27
nightly-2020.06.28
nightly-2020.06.29
nightly-2020.06.30

Other

pre-hhvm
src-hphp

Database specific

vanir_signatures

[
    {
        "target": {
            "file": "hphp/runtime/ext/fb/VariantController.h"
        },
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2020-1898-01d70c0b",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "91487532972145899339859786532574555263",
                "326407928188406100671830618769666613359",
                "21551178943104615310045052536714520650",
                "102643094137829386333481076476762460619",
                "53700757438239126383670650319917108424",
                "51500582980409683476804170736651155826",
                "156139227791915618986343167466951799836",
                "205429400389998191863297352820906755441",
                "170075102244105141743887749498636423900"
            ]
        }
    },
    {
        "target": {
            "function": "fb_compact_unserialize",
            "file": "hphp/runtime/ext/fb/ext_fb.cpp"
        },
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2020-1898-0a324714",
        "digest": {
            "function_hash": "270737160550213031684840760497248981145",
            "length": 280.0
        }
    },
    {
        "target": {
            "file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize.h"
        },
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2020-1898-434d5d61",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "271790096561396052972573032767504935933",
                "9777719731318520793473962057681738798",
                "61330576844675855404494413271248799124",
                "148174822824141929193172826518108165976",
                "328166032695495337147219091976196694868",
                "214349395177784171051225336605108284220",
                "82203661883655628963475664907581886558",
                "196692206186613515479464340605539317323",
                "263617574364114813576776252851971277771"
            ]
        }
    },
    {
        "target": {
            "function": "fb_compact_unserialize_from_buffer",
            "file": "hphp/runtime/ext/fb/ext_fb.cpp"
        },
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2020-1898-476b11cb",
        "digest": {
            "function_hash": "271762000487680987672107141546529577534",
            "length": 2764.0
        }
    },
    {
        "target": {
            "function": "unserializeSet",
            "file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h"
        },
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2020-1898-4b6aa8d1",
        "digest": {
            "function_hash": "131179548999697731911174089316538092118",
            "length": 249.0
        }
    },
    {
        "target": {
            "file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h"
        },
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2020-1898-77e235e3",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "181097208751375604965391235137227738901",
                "121698461318138829929899400579623271629",
                "135429370249437301008081810350940665424",
                "82830804432312628537095303834045631424",
                "211681232477740050467309956442190407689",
                "75042782117546863220999624039775972463",
                "305295146125328853423239815673352858386",
                "210021830632294832939226366541382590488",
                "95166611366815647396683735030895853612",
                "14696346859648069683903721257579375032",
                "204337556357967730450398344932202417421",
                "2163819038607280028979468262770280214",
                "250004932297632704380691985619804240173",
                "232600499681413757795049259759294775028",
                "306254961887074926476221494525247508884",
                "148727549268937441199599944718934469927",
                "144204313731998566398968955957564823409",
                "149744699588593285435672443775513587895",
                "175269912427601477650680453467816310439",
                "3421995533911580137166964287704163988",
                "281233161262593976314108105375163440949",
                "196704612081951055010595689762200058664",
                "339272939625009796129722680277925814069",
                "336901554468839498434373195411458189813",
                "316586586402976138935182021226085738937",
                "272483809826078039096693387273673111235",
                "67381580523396586748313209181317703136",
                "99416485322904319296561357989084698307",
                "90078555816722039571428649786829680225",
                "79842855803770429953299674130892450781",
                "31768561387076061940935759255384140469",
                "76966900588068684686280736706371855979",
                "316586586402976138935182021226085738937",
                "272483809826078039096693387273673111235",
                "67381580523396586748313209181317703136",
                "99416485322904319296561357989084698307",
                "34488496411511293633949836587695075141",
                "263117713334405570814752022705720519454",
                "199210392761886388648445153050430910664",
                "90707207527845928145103593251122919086",
                "20070347726977164041672427603721609124",
                "54565153198004311721761104482579936494",
                "139384008962080267268602386710099234271",
                "136135124634485320899446060054901900310",
                "289002659891145344022660396593862677384",
                "48619848544934364128056366835792962591",
                "17399270253366887314832616289718845033",
                "85530110898555858096741888130966498537",
                "157592902291414109913674787743122528163",
                "131813258107557863092345723158974952640",
                "136990148100903220024894579152205620960",
                "325539388195157626135104758799847475932",
                "305506700244020877028419029244522423197",
                "271366903355991008841625501196561127224",
                "87533374115222047841924654782970141293",
                "71576062193290989306630992866321551834",
                "237152297563026333202164852481578788192",
                "79142347360811686808639275467142433923",
                "237469874781761932968372514611900243207",
                "35894163888992830136615593610239932676"
            ]
        }
    },
    {
        "target": {
            "function": "unserializeThing",
            "file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h"
        },
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2020-1898-c1ac316e",
        "digest": {
            "function_hash": "145715691786455768944710079437504065661",
            "length": 912.0
        }
    },
    {
        "target": {
            "function": "unserializeMap",
            "file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h"
        },
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2020-1898-ccaf80e7",
        "digest": {
            "function_hash": "321209806354837655737085289434882826264",
            "length": 534.0
        }
    },
    {
        "target": {
            "file": "hphp/runtime/ext/fb/ext_fb.cpp"
        },
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2020-1898-cf852ae4",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "77006485962835594863492230187087547999",
                "123957483544480932709462742203186491198",
                "324681381068544546520157064078432699624",
                "271967712181457776094316578430023955513",
                "35746439978163504071255577375952994696",
                "111701038126874625709433477144313928043",
                "108014145752157512970262006775223792028",
                "280451824540892538894098383718527695398",
                "320881997547167147634222381860457807325",
                "72015313253364208385273246189682791222",
                "194135605952048905490590313043815329918",
                "240497766763099138711501000616704534478",
                "86388656772682628234950305282997416734",
                "72015313253364208385273246189682791222",
                "194135605952048905490590313043815329918",
                "292435924164227485136877448263016733147",
                "278787093222326728305751580044975795474",
                "84139057522681045445478782799070479822",
                "269264687466355196920710521358068180660",
                "241969532403504386394671267598711269430",
                "303070558977685776563107764204445381952",
                "315109574514569473482783075745242172394",
                "4832331348182810375331403790253801695",
                "214966448798573362370817321954941242487",
                "340026193505294365835262781562179029586",
                "284307659605833258428869604414483006252",
                "184991282801291342908007206010620625537",
                "318734695729083989957630994407767660060",
                "259743913818355546975421964218325780269",
                "84538782393050635331448289889279151247",
                "301644608005518607027712444785770546991",
                "89648503310483090253605690973090250947"
            ]
        }
    },
    {
        "target": {
            "function": "unserialize",
            "file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h"
        },
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2020-1898-d4e66146",
        "digest": {
            "function_hash": "283275413755843508387453944612336227178",
            "length": 86.0
        }
    },
    {
        "target": {
            "function": "unserializeVector",
            "file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h"
        },
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2020-1898-d9284bff",
        "digest": {
            "function_hash": "151197539678440144023640981284665104395",
            "length": 240.0
        }
    },
    {
        "target": {
            "function": "unserializeList",
            "file": "hphp/runtime/ext/fb/FBSerialize/FBSerialize-inl.h"
        },
        "source": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2020-1898-e7632df2",
        "digest": {
            "function_hash": "328503010626063701618965234357099058815",
            "length": 255.0
        }
    }
]