GHSA-7mhc-prgv-r3q4

Source

https://github.com/advisories/GHSA-7mhc-prgv-r3q4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-7mhc-prgv-r3q4/GHSA-7mhc-prgv-r3q4.json

Aliases

• CVE-2021-24044

Published

2022-01-16T00:00:45Z

Modified

2023-11-08T04:05:14.417618Z

Details

By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a consequence of type confusion error, with a low chance of RCE. This issue affects Hermes versions prior to v0.10.0.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-24044
• https://github.com/facebook/hermes
• https://www.facebook.com/security/advisories/cve-2021-24044