Security readout for executives and security teams
Plain-English summary
HHVM versions before 3.3.0 could generate predictable or repeated cryptographic initialization vectors because mcrypt_create_iv did not seed its random number generator. That can weaken encryption or other protections that depend on unique random values. The sources do not provide a CVSS score or evidence of active exploitation.
Executive priority
Treat as a targeted legacy-platform risk. Prioritize if old HHVM supports customer-facing or sensitive-data applications. Without evidence of active exploitation or a CVSS score, urgency depends on whether vulnerable HHVM and affected cryptographic usage exist internally.
Technical view
The issue is in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp: mcrypt_create_iv failed to seed the RNG in HHVM before 3.3.0. A remote attacker could more easily defeat cryptographic protection mechanisms where applications relied on a single or repeated initialization vector.
Likely exposure
Exposure is limited to systems running Facebook HHVM before 3.3.0 and applications that used mcrypt_create_iv for cryptographic IV generation. The source bundle does not identify broader products, package names, or default configurations.
Exploitation context
CISA KEV status is false, and the provided sources do not claim active exploitation. The CVE describes remote attackers potentially weakening cryptographic protections, but no exploit maturity, real-world incidents, or exploitation prerequisites are provided.
Researcher notes
Evidence is sparse: the CVE description and one HHVM commit are the main sources. Focus validation on version confirmation and whether application security actually depended on mcrypt_create_iv output. Avoid assuming impact where the function was unused.
Mitigation direction
- Upgrade HHVM deployments to version 3.3.0 or later.
- Review the referenced HHVM commit and vendor guidance before production rollout.
- Identify applications relying on mcrypt_create_iv for cryptographic initialization vectors.
- Assess whether affected encrypted data or tokens need rotation after remediation.
Validation and detection
- Inventory HHVM versions and flag any deployment before 3.3.0.
- Search application code for mcrypt_create_iv usage under HHVM.
- Confirm upgraded systems include the referenced RNG seeding change.
- Review cryptographic workflows for repeated or single-IV assumptions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2014-5386 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/facebook/hhvm/commit/ab6fdeb84fb090b48606b6f7933028cfe7bf3a5eCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.