Heap-use-after-free vulnerability in zend_reference_destroy in php
Summary
OSV-2023-1243: Heap-use-after-free in zend_reference_destroy. Affects php versions >= 423a1e586e186d1df7838216a88b63b67f37afea, < 1e55c9760178f9d5e1de8b251537b3e8ccf44feb. Fixed in 1e55c9760178f9d5e1de8b251537b3e8ccf44feb. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a popular general-purpose scripting language that is widely used for web development. It is known for its simplicity and flexibility, making it a preferred choice for many developers. The zend_reference_destroy function is a part of the PHP Zend Engine, which is responsible for executing PHP scripts. This vulnerability specifically affects the zend_reference_destroy function, leading to a heap-use-after-free issue.
Vulnerability Detail
The heap-use-after-free vulnerability in zend_reference_destroy arises when the function attempts to access memory that has already been freed. This can occur due to improper handling of references in certain scenarios. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition. The vulnerability was discovered through the OSS-Fuzz project, which identified a crash caused by a heap-use-after-free read of 4 bytes.
How To Fix
Minimum fixed version
1e55c9760178f9d5e1de8b251537b3e8ccf44feb
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can modify the affected code to avoid triggering the vulnerable function or use alternative approaches that do not rely on the zend_reference_destroy function. However, it is strongly advised to apply the official fix provided by the PHP development team as soon as possible.
Conclusion
The heap-use-after-free vulnerability in zend_reference_destroy poses a significant risk to PHP applications. It is crucial to promptly update the PHP package to the latest version that includes the necessary patches. Additionally, developers should follow secure coding practices and regularly monitor for any new vulnerabilities that may arise. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for php →
FAQ
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition on a PHP application.
The vulnerability was discovered through the OSS-Fuzz project, which identified a crash caused by a heap-use-after-free read of 4 bytes.
No, only versions introduced after commit 423a1e586e186d1df7838216a88b63b67f37afea in the PHP source code repository are affected.
Yes, the PHP development team has released fixes for this vulnerability in the latest versions of PHP. It is recommended to update to the latest version to mitigate the risk.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will provide real-time alerts for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
