Heap-use-after-free vulnerability in zend_ast_evaluate_inner in PHP
Summary
OSV-2023-69: Heap-use-after-free in zend_ast_evaluate_inner. Affects php versions >= 35a36b13e539c252d309f1799b5f653cf76921bd, < 1978a7b393ebbf5018e07b42ba65325282eee336. Fixed in 1978a7b393ebbf5018e07b42ba65325282eee336. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a popular open-source programming language widely used for web development. It provides a powerful and flexible platform for building dynamic websites and applications. The zend_ast_evaluate_inner function is a critical component of the PHP interpreter that evaluates abstract syntax trees (ASTs) during runtime. This vulnerability affects the PHP package and can lead to a heap-use-after-free condition, potentially resulting in a crash or arbitrary code execution.
Vulnerability Detail
The heap-use-after-free vulnerability in zend_ast_evaluate_inner arises due to improper memory management. When evaluating ASTs, the function fails to handle certain scenarios correctly, leading to a situation where memory is accessed after it has been freed. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. The vulnerability has been assigned a severity rating of HIGH.
How To Fix
Minimum fixed version
1978a7b393ebbf5018e07b42ba65325282eee336
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At present, no known workarounds exist for this vulnerability. It is essential to apply the recommended fix by updating the PHP package to a patched version.
Conclusion
The heap-use-after-free vulnerability in zend_ast_evaluate_inner poses a significant risk to PHP applications. It is crucial to update the PHP package to a patched version that includes the fix. Failure to do so may result in arbitrary code execution or denial-of-service attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for php →
FAQ
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition in PHP applications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
No, only versions of PHP up to the commit 1978a7b393ebbf5018e07b42ba65325282eee336 are affected. Users should update to a patched version to mitigate the vulnerability.
At the time of this report, there are no known public exploits targeting this vulnerability. However, it is crucial to apply the recommended fix to prevent any potential exploitation.
You can find more information about this vulnerability in the OSS-Fuzz report at https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56021.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
