Security readout for executives and security teams
Plain-English summary
This CVE affects legacy Facebook HHVM versions before 3.3.0. A crafted use of PHP's chunk_split function can trigger an integer overflow and crash the application. The public record supports denial of service; broader impact is described only as possible and unspecified.
Executive priority
Treat as a legacy-platform availability risk. Prioritize remediation if HHVM before 3.3.0 supports public or business-critical services. If HHVM is not present, record non-exposure and no emergency action is indicated.
Technical view
The flaw is an integer overflow in string_chunk_split in hphp/runtime/base/zend-string.cpp. Remote attackers may cause an HHVM application crash by supplying crafted arguments to chunk_split. Sources identify HHVM before 3.3.0 and a confirming GitHub commit, but provide no CVSS score or detailed affected CPEs.
Likely exposure
Exposure is limited to systems running Facebook HHVM before 3.3.0, especially internet-facing PHP/Hack services where chunk_split receives user-influenced arguments. Modern environments not using HHVM, or using later supported HHVM versions, are less likely to be affected.
Exploitation context
The CVE says remote attackers can cause denial of service or possibly unspecified impact. CISA KEV status is false in the provided bundle, and no cited source confirms active exploitation or public exploit availability.
Researcher notes
The source data is sparse: no CVSS, no CWE, no CPEs, and no exploit telemetry. Analysis should stay anchored to HHVM before 3.3.0, the chunk_split integer overflow, and the documented denial-of-service outcome.
Mitigation direction
- Inventory production and legacy environments for HHVM usage.
- Upgrade HHVM versions before 3.3.0 according to vendor guidance.
- Prioritize public services that process user-controlled data with chunk_split.
- Review the referenced vendor commit and release notes before change rollout.
- Monitor affected applications for unexplained HHVM crashes.
Validation and detection
- Confirm whether HHVM is installed and identify its exact version.
- Flag any HHVM version earlier than 3.3.0 for remediation.
- Review application code paths using chunk_split with external input.
- Check crash logs for failures around string handling or chunk_split.
- Document whether affected services are internet-facing or internal only.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2014-6228 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/facebook/hhvm/commit/1f91e076a585118495b976a413c1df40f6fd3d41CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.