CVE-2022-40138

 

Published at: - 11-10-2022 04:15

Last modified: - 11-10-2022 09:10

Total changes: - 1

Description

An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bounds operations and subsequently execute arbitrary code. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://www.facebook.com/security/advisories/CVE-2022-40138
• https://github.com/facebook/hermes/commit/6aa825e480d48127b480b08d13adf70033237097

 

Keywords

NVD

 

CVE-2022-40138

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures