Heap-use-after-free in zend_hash_iterator_pos_ex in PHP
Summary
OSV-2021-455: Heap-use-after-free in zend_hash_iterator_pos_ex. Affects php versions >= 1902f730ee2bda60552f34c0643e2d7b47e4fb64, < 5875bf754ed4fc64a6f0b7d62734d2a816c51017. Fixed in 5875bf754ed4fc64a6f0b7d62734d2a816c51017. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a popular open-source scripting language used for web development. It is widely known for its simplicity and flexibility, making it a preferred choice for building dynamic websites and applications. The zend_hash_iterator_pos_ex function in PHP is responsible for iterating over hash tables. However, a vulnerability has been discovered in this function that can lead to a heap-use-after-free condition.
Vulnerability Detail
The heap-use-after-free vulnerability in zend_hash_iterator_pos_ex can be triggered when a hash table is iterated over, and a specific condition is met. This can result in the use of previously freed memory, leading to unexpected behavior or a crash. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service attack.
How To Fix
Minimum fixed version
5875bf754ed4fc64a6f0b7d62734d2a816c51017
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading PHP is not immediately feasible, a possible workaround is to avoid using the zend_hash_iterator_pos_ex function or any code that relies on it. By avoiding the use of this function, the vulnerability can be mitigated. However, this workaround may not be suitable for all scenarios and should be thoroughly tested before implementation.
Conclusion
In conclusion, a heap-use-after-free vulnerability has been discovered in the zend_hash_iterator_pos_ex function in PHP. This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service attack. It is crucial to update PHP to a version that includes the fix or apply the recommended workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for php →
FAQ
The vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service attack.
You can use the Vulert playground at Vulert Scanner to check if your PHP installation is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will provide real-time alerts for any open-source vulnerabilities, including this one.
Yes, a patch has been released to address this vulnerability. Users should update their PHP installation to a version that includes the fix.
At the time of this report, there are no known exploits for this vulnerability. However, it is important to apply the patch as soon as possible to prevent any potential exploitation.
While upgrading PHP is the recommended solution, you can mitigate this vulnerability by avoiding the use of the zend_hash_iterator_pos_ex function or any code that relies on it. However, this workaround may not be suitable for all scenarios and should be thoroughly tested.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
