Heap-use-after-free in zend_gc_addref in PHP
Summary
OSV-2020-1779: Heap-use-after-free in zend_gc_addref. Affects php across 2 version ranges.
>= 4e198c00646604b5fe6726cdc9eba4c2b7861ce2
>= f51bbcc2b2fd54ce75bf7d554a010c5bb5ea991d, < dd4a080133b7b0570b629cdfb7c9e2651bdf88f7
Fixed in dd4a080133b7b0570b629cdfb7c9e2651bdf88f7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PHP is a popular general-purpose scripting language that is widely used for web development. It is known for its flexibility and ease of use. The zend_gc_addref function in PHP is responsible for adding a reference to a garbage-collected object. However, a vulnerability has been discovered in this function that can lead to a heap-use-after-free condition. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial of service.
Vulnerability Detail
The vulnerability occurs due to a use-after-free bug in the zend_gc_addref function. When a generator object is destroyed, the zend_generator_dtor_storage function is called, which in turn calls zend_generator_update_current. However, if the generator object is modified during the destruction process, a use-after-free condition can occur when zend_generator_update_current tries to access the object. This can lead to a crash or allow an attacker to execute arbitrary code.
How To Fix
Minimum fixed version
dd4a080133b7b0570b629cdfb7c9e2651bdf88f7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is currently no known workaround for this vulnerability. It is recommended to update to a patched version of PHP as soon as possible.
Conclusion
In conclusion, the zend_gc_addref function in PHP is vulnerable to a heap-use-after-free condition. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial of service. It is recommended to update to a patched version of PHP to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for php →
FAQ
This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any known vulnerabilities, including this one.
Yes, the vulnerability has been fixed in the PHP source code. It is recommended to update to a version of PHP that includes the fix.
No, there are currently no known workarounds for this vulnerability. It is recommended to update to a patched version of PHP.
You can find more information about this vulnerability in the OSS-Fuzz report at https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25697.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
