Executive brief
Hermes is a JavaScript engine used to power React Native applications. A type confusion vulnerability allows attackers to crash the engine or potentially execute arbitrary code by supplying specially crafted JavaScript code that misuses async and yield keywords in getter/setter functions, leading to memory safety violations.
Technical details
This vulnerability is a type confusion (CWE-843) in Hermes' handling of async/generator syntax in non-async/non-generator getter and setter functions. When invalid JavaScript code attempts to use await or yield in these contexts, Hermes incorrectly invokes generator functions without proper type validation, resulting in a segmentation fault due to memory safety violations. The attack requires no authentication and is remotely exploitable via network-delivered JavaScript code (e.g., web views, RN applications). Attackers can achieve denial of service through crash, with a low but plausible probability of remote code execution. The vulnerability is resolved in Hermes v0.10.0 and later.
Affected products
- Facebook Hermes prior to 0.10.0
Timeline
- 2022-01-16: disclosed
- 2022-01-16: patched: Fixed in v0.10.0