Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-24044

By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
facebook

Description

By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a consequence of type confusion error, with a low chance of RCE. This issue affects Hermes versions prior to v0.10.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Facebook Hermes

  • 0.10.0 to < unspecifiedunaffected
  • unspecified to < 0.10.0affected

References