Heap-use-after-free vulnerability in user_wrapper_opendir in php
Summary
OSV-2022-863: Heap-use-after-free in user_wrapper_opendir. Affects php across 2 version ranges.
< 9af98cd4657bfcfe21f42ab36d9be7de7b2709b2
>= cae80ef552c7da262e8070264ccf778454477a08, < 09aa27cc0993e321678b6e66a1d3fc428b6e3c59
Fixed in 09aa27cc0993e321678b6e66a1d3fc428b6e3c59. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a popular open-source scripting language used for web development. It is widely used for creating dynamic web pages and applications. The vulnerability in question affects the user_wrapper_opendir function in PHP, which is responsible for opening a directory handle. This vulnerability can lead to a heap-use-after-free condition, where a program continues to use a memory block after it has been freed. This can result in various security issues, including potential remote code execution or denial of service attacks.
Vulnerability Detail
The vulnerability originates from a heap-use-after-free condition in the user_wrapper_opendir function. This can occur when the function attempts to use a memory block that has already been freed. An attacker can potentially exploit this vulnerability by crafting a malicious input that triggers the use of the freed memory block. This can lead to arbitrary code execution or other security issues. The vulnerability has been assigned a severity rating of HIGH.
How To Fix
Minimum fixed version
09aa27cc0993e321678b6e66a1d3fc428b6e3c59
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the PHP package is not immediately feasible, a possible workaround is to avoid using the user_wrapper_opendir function or any code that relies on it. By avoiding the use of this function, the vulnerability can be mitigated. However, this workaround may not be applicable in all scenarios and it is still recommended to update to a patched version of PHP as soon as possible.
Conclusion
The heap-use-after-free vulnerability in the user_wrapper_opendir function in PHP can have serious security implications, including potential remote code execution or denial of service attacks. It is crucial to update the affected PHP package to a patched version as soon as possible. If immediate updating is not feasible, avoiding the use of the vulnerable function can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for php →
FAQ
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial of service by exploiting the heap-use-after-free condition in the user_wrapper_opendir function.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to patch the affected PHP package as soon as possible to prevent any potential exploitation.
Yes, this vulnerability can be exploited remotely. An attacker can craft a malicious input that triggers the use of the freed memory block, potentially leading to remote code execution or other security issues.
At the time of this report, there is no CVE assigned to this vulnerability. However, it is recommended to stay updated with the latest security advisories and CVE assignments for PHP to ensure timely patching.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
