Facebook Folly vulnerabilities

3 CVEs affecting Facebook Folly, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-24036, published 2021-07-23.

More from Facebook.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-24036, published 2021-07-23. Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days. Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue…
• CVE-2018-6337, published 2018-12-31. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects…
• CVE-2019-11934, published 2019-12-04. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. Improper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket. This issue affects folly prior to v2019.11.04.00.