CVE-2018-6337
published 2018-12-31CVE-2018-6337: folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing…
PriorityP338high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
1.78%
75.4th percentile
folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| folly | — | — | |
| folly | 2017.12.11.00 – 2018.08.09.00 | — | |
| folly | >= v2017.12.11.00 < unspecified | unspecified | |
| hhvm | — | — | |
| hhvm | >= 3.26 < 3.26.3 | 3.26.3 | |
| hhvm | >= 3.26.0 < unspecified | unspecified |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761fhttps://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.htmlhttps://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761fhttps://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.html
2018-12-31
Published