Junglewise Threat Intelligence

CVE-2021-24044: Facebook Hermes type confusion via async/yield in getters/setters

CVE-2021-24044 · Severity: low · CVSS 3.1 · Published 2022-01-16

Technologies: hermes-engine (npm). Vendors: npm.

Executive brief

Hermes is a JavaScript engine used to power React Native applications. A type confusion vulnerability allows attackers to crash the engine or potentially execute arbitrary code by supplying specially crafted JavaScript code that misuses async and yield keywords in getter/setter functions, leading to memory safety violations.

Technical details

This vulnerability is a type confusion (CWE-843) in Hermes' handling of async/generator syntax in non-async/non-generator getter and setter functions. When invalid JavaScript code attempts to use await or yield in these contexts, Hermes incorrectly invokes generator functions without proper type validation, resulting in a segmentation fault due to memory safety violations. The attack requires no authentication and is remotely exploitable via network-delivered JavaScript code (e.g., web views, RN applications). Attackers can achieve denial of service through crash, with a low but plausible probability of remote code execution. The vulnerability is resolved in Hermes v0.10.0 and later.

Affected products

  • Facebook Hermes prior to 0.10.0

Timeline

  • 2022-01-16: disclosed
  • 2022-01-16: patched: Fixed in v0.10.0

References

Related threats