Executive brief
Facebook Hermes is a JavaScript engine used to optimize React Native applications. A logic error in how the engine handles specific instructions could allow an attacker to read sensitive memory or execute unauthorized code. This risk primarily affects applications that allow the execution of untrusted or user-provided JavaScript code.
Technical details
A logic vulnerability exists in the Facebook Hermes JavaScript engine when handling the SaveGeneratorLong instruction. The root cause is an incorrect control flow implementation where the engine would jump to an incorrect next instruction based on the length of the SaveGenerator instruction. An attacker can exploit this by providing crafted JavaScript to trigger an out-of-bounds read or potentially achieve arbitrary code execution. This vulnerability is only exploitable in environments where the application permits the evaluation of untrusted JavaScript. The issue was addressed in version 0.7.2 by ensuring the interpreter loop correctly dispatches the next instruction.
Affected products
- Facebook hermes-engine <= 0.7.1
Timeline
- 2020-10-08: advisory: NVD and Facebook published initial advisory
- 2020-10-01: patched: Fix committed to Hermes repository
- 2022-05-24: disclosed: GitHub Advisory published