Is CVE-2020-1913 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-1913 being exploited in the wild.

How severe is CVE-2020-1913?

Low severity, with a CVSS score of 3.1, published 24 May 2022.

Which products and versions are affected?

Meta Hermes prior to 0.5.2; hermes-engine (npm) SEMVER:introduced=0,fixed=0.5.2.

Is there a fix for CVE-2020-1913?

Yes. hermes-engine (npm): upgrade to 0.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-1913 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-1913?

Check whether you run Meta Hermes or hermes-engine (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-1913: Facebook Hermes signed to unsigned conversion error

CVE-2020-1913 · Severity: low · CVSS 3.1 · Published 2022-05-24

Facebook Hermes is a JavaScript engine used primarily in React Native applications to execute JavaScript code. A signedness conversion error in the interpreter can allow attackers to crash the application or potentially execute arbitrary code if the app permits evaluation of untrusted JavaScript. Most standard React Native applications are not affected, but those that dynamically execute untrusted scripts face elevated risk.

Technologies: Meta Hermes, hermes-engine (npm). Vendors: Meta, npm.

Quick answers

Is CVE-2020-1913 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-1913 being exploited in the wild.
How severe is CVE-2020-1913?: Low severity, with a CVSS score of 3.1, published 24 May 2022.
Which products and versions are affected?: Meta Hermes prior to 0.5.2; hermes-engine (npm) SEMVER:introduced=0,fixed=0.5.2.
Is there a fix for CVE-2020-1913?: Yes. hermes-engine (npm): upgrade to 0.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-1913 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-1913?: Check whether you run Meta Hermes or hermes-engine (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

hermes-engine (npm): upgrade to 0.5.2 or later
```
npm install hermes-engine@0.5.2
```

Technical details

The vulnerability is an integer signedness error (CWE-195, CWE-681) in the SwitchImm instruction handler of the JavaScript interpreter. The flaw involves reading a signed offset from an unsigned 32-bit pointer instead of a signed 32-bit pointer, allowing crafted JavaScript to bypass branching logic or corrupt instruction pointer calculations. The attack is network-reachable if the application evaluates untrusted JavaScript. An attacker can trigger a denial of service or potentially achieve remote code execution via malformed JavaScript bytecode. The fix, committed as 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6, corrects the type casting for backward branch offset handling. Versions 0.5.2 and later contain the patch.

Affected products

Meta Hermes prior to 0.5.2

Identifiers

CVE-2020-1913
GHSA-gmpm-xp43-f7g6

Timeline

2020-09-09: disclosed: CVE-2020-1913 published to NVD
2022-05-24: patched: GHSA advisory published; fix available in version 0.5.2

References

https://github.com/facebook/hermes/commit/2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.