folly::secureRandom will re-use a buffer between parent and child processes when fork() is called.

Published 7 y ago 2018-12-31 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.1 · CNA

CISA KEV

not known exploited

EPSS

1.8%

percentile 78%

Public exploits

none known

folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00.

CISA SSVC assessment

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 18 mo ago 2025-05-06

Exploit prediction (EPSS)

1.78% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`
CNA	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`
NVD	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:N/I:P/A:N`

Affected products

Facebook HHVM
Facebook folly

Classification

Weakness

CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

hhvm.com /blog/2018/05/24/hhvm-3.26.3.html · x_refsource_MISC, x_transferred
github.com /facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761f · x_refsource_MISC, x_transferred
github.com /facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8 · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2018-6337
NVD: CVE-2018-6337

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary