In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.
The vulnerability (CWE-416, use-after-free) occurs when a sequence of code involves the magic handler __set or the null-coalescing assignment operator (??=) along with exception handling mechanism, which causes a reference to a memory area after it has been freed. An attacker who is able to control memory layout — for example by providing specially crafted input data to a PHP script — can exploit this flaw. A properly constructed payload can lead to arbitrary code execution in the context of the PHP process.
An attacker may gain the ability to execute code remotely (RCE) on a server running a vulnerable version of PHP, which could result in complete takeover of the application and system.
PHP should be updated to version 8.3.19 or later (for the 8.3 branch) or to version 8.4.5 or later (for the 8.4 branch). Details are available in the official PHP security advisory on GitHub: https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477
PHP versions 8.3.x before 8.3.19 and PHP 8.4.x before 8.4.5
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:AmberPHP
APPPhp8.3.0 – 8.3.19 (excl.)8.4.0 – 8.4.5 (excl.)
Related vulnerabilities
PHP CGI argument injection – RCE na Windows przez mechanizm Best-Fit
RCE w PHP-CGI poprzez wstrzyknięcie opcji wiersza poleceń
Use-after-free w rozszerzeniu SOAP PHP umożliwiające RCE
PHP PDO SQLite — błędne cytowanie ciągów prowadzące do SQL injection
PHP: integer overflow w ldap_escape() prowadzący do out-of-bounds write