# Facebook Fizz integer overflow vulnerability (CVE-2019-3560)

Integer overflow in Fizz TLS PlaintextRecordLayer length += causes infinite loop, letting an unauthenticated attacker send a 64KB TCP message to hang a CPU core.

- Payout: $10,000
- Severity: high
- Program: Meta / Facebook
- Credited: Kevin Backhouse
- Disclosed: 2019-03-19
- CVE: CVE-2019-3560
- Write-up quality: 8/10
- Original: https://securitylab.github.com/research/facebook-fizz-CVE-2019-3560/
- Library page: https://bugbountylibrary.com/r/blog%3Asecuritylab-github-com-research-facebook-fizz-cve-2019-3560
- Tags: domain:network impact:dos kind:bounty platform:blog sev:high tech:linux technique:chained technique:source-review vuln:dos vuln:memory-corruption

**Target:** TLS record layer parser (PlaintextRecordLayer.cpp) in Fizz library
**Root cause:** Attacker-controlled uint16_t length is added to sizeof(ContentType)+sizeof(ProtocolVersion)+sizeof(uint16_t) in a uint16_t, overflowing to 0 when length=0xFFFB, so trimStart consumes nothing and the parse loop never advances.
**Steps:**
1. Open TCP socket to a Fizz server.
2. Send a payload just over 64KB so the buffer contains at least `length` bytes (needed to pass the `buf.chainLength() < (cursor - buf.front()) + length` check).
3. Craft the record so the parsed uint16 length field equals `0xFFFB`.
4. On `length += sizeof(ContentType)+sizeof(ProtocolVersion)+sizeof(uint16_t)`, length wraps to 0.
5. `buf.trimStart(0)` consumes no data; loop iterates forever, pinning one CPU core.
**How found:** Used a CodeQL query (Jonas Jensen's IR-based version) to find narrowing conversions tainted by network data. Modeled untrusted input via Folly's `Endian::big()` (Fizz's ntohs/ntohl equivalent) as taint source and narrowing ConvertInstruction as sink; query returned exactly one result — the vulnerable line.
**Exploitation:** Unauthenticated remote attacker sends a single ~64KB TCP message to any Fizz-based server; each message wedges one CPU core in an infinite loop. At 1Mbps upload a single host sends ~2 messages/sec, so a small botnet can debilitate a datacenter.
**Insight:** When hunting parsers, treat endianness-conversion helpers (ntohs/ntohl or custom equivalents like Endian::big) as taint sources for network data, and grep for narrowing conversions of length fields into smaller integer types before they feed buffer-advance arithmetic — overflow-to-zero silently defeats loop progress.