CVE-2021-24044

Vulnerability

Hermes, a JavaScript engine optimized for React Native, contains a type confusion vulnerability in versions prior to v0.10.0. By passing invalid JavaScript code where await and yield are called upon non-async and non-generator getter/setter functions, Hermes incorrectly invokes generator functions and errors out on invalid await/yield positions [1][3]. This can result in a segmentation fault due to a type confusion error [1][3].

Exploitation

An attacker needs the ability to supply arbitrary JavaScript code to the Hermes engine, such as through a malicious React Native app or a crafted script. The attacker must craft code that triggers await or yield inside a getter or setter that is not declared async or yield* respectively. No special network position or authentication is required beyond the ability to run the code [1][3].

Impact

Successful exploitation causes a segmentation fault (crash) and could potentially lead to remote code execution (RCE), though the reference notes this is a low chance [1][3]. Confidentiality, integrity, and availability may be compromised if RCE is achieved, but the primary impact observed is denial of service via crash [1][3].

Mitigation

Facebook released a fix in Hermes version v0.10.0 [1][3]. Users should upgrade to v0.10.0 or later. No workarounds are documented. There is no indication this CVE is listed on CISA's Known Exploited Vulnerabilities (KEV) catalog [1][3].