Quick answers
- Is CVE-2020-1914 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-1914 being exploited in the wild.
- How severe is CVE-2020-1914?
- Low severity, with a CVSS score of 3.1, published 24 May 2022.
- Which products and versions are affected?
- Meta Hermes <= 0.7.1; hermes-engine (npm) SEMVER:introduced=0,fixed=0.7.2.
- Is there a fix for CVE-2020-1914?
- Yes. hermes-engine (npm): upgrade to 0.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-1914 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2020-1914?
- Check whether you run Meta Hermes or hermes-engine (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- hermes-engine (npm): upgrade to 0.7.2 or later
npm install hermes-engine@0.7.2
Technical details
A logic vulnerability exists in the Facebook Hermes JavaScript engine when handling the SaveGeneratorLong instruction. The root cause is an incorrect control flow implementation where the engine would jump to an incorrect next instruction based on the length of the SaveGenerator instruction. An attacker can exploit this by providing crafted JavaScript to trigger an out-of-bounds read or potentially achieve arbitrary code execution. This vulnerability is only exploitable in environments where the application permits the evaluation of untrusted JavaScript. The issue was addressed in version 0.7.2 by ensuring the interpreter loop correctly dispatches the next instruction.
Affected products
- Facebook hermes-engine <= 0.7.1
Identifiers
- CVE-2020-1914
- GHSA-327c-qx3v-h673
Timeline
- 2020-10-08: advisory: NVD and Facebook published initial advisory
- 2020-10-01: patched: Fix committed to Hermes repository
- 2022-05-24: disclosed: GitHub Advisory published