GitHub Advisoryadvisory · npm

GHSA-7mhc-prgv-r3q4 Access of Resource Using Incompatible Type in Hermes

CRITICAL Published 2022-01-16 Modified 2022-06-22 Official page ↗
Aliases
CVE-2021-24044
Ecosystem
npm
Packages
hermes-engine
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-843
Reviewed
2022-06-22

Affected packages

• npm hermes-engine: < 0.10.0 → fixed in 0.10.0

Description

By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a consequence of type confusion error, with a low chance of RCE. This issue affects Hermes versions prior to v0.10.0.

Related

Alias · CVE (1)

  • CVE-2021-24044 By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would… vulnerability

Weakness · CWE (1)

  • CWE-843 Access of Resource Using Incompatible Type weakness

References