Heap-use-after-free vulnerability in zend_gc_delref in php
Summary
OSV-2020-1735: Heap-use-after-free in zend_gc_delref. Affects php versions >= 927771333ba28570d1a5dc4bdc5b1a2a13ff3774, < 3c53732332c4b9d3904eec0d1c42f0d4d4bf65c6. Fixed in 3c53732332c4b9d3904eec0d1c42f0d4d4bf65c6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a popular general-purpose scripting language that is widely used for web development. It is known for its simplicity, flexibility, and extensive support for various databases. The zend_gc_delref function in PHP is responsible for garbage collection and reference counting of zval structures. This vulnerability in zend_gc_delref can lead to a heap-use-after-free condition, where a reference to a freed memory location is still being accessed. This can result in a crash or potentially allow an attacker to execute arbitrary code.
Vulnerability Detail
The vulnerability occurs due to a heap-use-after-free condition in the zend_gc_delref function. This can be triggered when the function is called to decrement the reference count of a zval structure that has already been freed. As a result, the function may attempt to access memory that has been freed, leading to undefined behavior. An attacker may be able to exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition.
How To Fix
Minimum fixed version
3c53732332c4b9d3904eec0d1c42f0d4d4bf65c6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to a fixed version of PHP as soon as possible.
Conclusion
The heap-use-after-free vulnerability in zend_gc_delref in PHP can lead to crashes or potential code execution. It is crucial to update to a fixed version of PHP to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for php →
FAQ
This vulnerability can lead to a crash or potentially allow an attacker to execute arbitrary code.
You can use the Vulert Playground at Vulert Scanner to check if your PHP installation is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for vulnerabilities in real-time.
There is no known exploit for this vulnerability at the time of writing. However, it is important to update to a fixed version of PHP to mitigate the risk.
No, only versions of PHP prior to the fix implemented in commit 3c53732332c4b9d3904eec0d1c42f0d4d4bf65c6 are affected. Users should update to a version that includes this commit or a later version.
Yes, a patch for this vulnerability is available in the PHP source code repository. Users should update their PHP installation to a version that includes this patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
