Executive brief
Facebook Hermes is a JavaScript engine used primarily in React Native applications to execute JavaScript code. A signedness conversion error in the interpreter can allow attackers to crash the application or potentially execute arbitrary code if the app permits evaluation of untrusted JavaScript. Most standard React Native applications are not affected, but those that dynamically execute untrusted scripts face elevated risk.
Technical details
The vulnerability is an integer signedness error (CWE-195, CWE-681) in the SwitchImm instruction handler of the JavaScript interpreter. The flaw involves reading a signed offset from an unsigned 32-bit pointer instead of a signed 32-bit pointer, allowing crafted JavaScript to bypass branching logic or corrupt instruction pointer calculations. The attack is network-reachable if the application evaluates untrusted JavaScript. An attacker can trigger a denial of service or potentially achieve remote code execution via malformed JavaScript bytecode. The fix, committed as 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6, corrects the type casting for backward branch offset handling. Versions 0.5.2 and later contain the patch.
Affected products
- Meta Hermes prior to 0.5.2
Timeline
- 2020-09-09: disclosed: CVE-2020-1913 published to NVD
- 2022-05-24: patched: GHSA advisory published; fix available in version 0.5.2