CVE-2018-6337CWE-212

folly::secureRandom will re-use a buffer between parent and child processes when fork() is called

High · published December 31, 2018

CVSS v3.1
7.5
EPSS
2%
Percentile
77.9
In the wild
Unconfirmed
What it is

folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01778 · 77.9th percentile
Weakness
CWE-212 · Improper Removal of Sensitive Information Before Storage or Transfer
Published
2018-12-31T22:00Z
EPSS history
Timeline
  • 31 DEC 22:00Z
    folly::secureRandom will re-use a buffer between parent and child processes when fork() is called
    cvelistv5