Описание
In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.
A flaw was found in PHP. This vulnerability allows remote code execution via a crafted code path involving the __set magic method or the null coalescing assignment (??=) operator, in combination with exception handling. Attackers can trigger a use-after-free condition by controlling the memory layout through specially crafted inputs.
Отчет
This vulnerability marked as Important instead of Moderate because it leads to a use-after-free condition, allowing attackers to exploit PHP’s memory management for remote code execution. Unlike moderate flaws that might cause limited disruption, this issue arises from a dangerous interaction between the __set method or the ??= operator and exceptions, leading to freed memory being accessed unpredictably. If an attacker can control the memory layout through crafted inputs, they can hijack execution flow, making this a severe risk in real-world PHP applications.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | php | Out of support scope | ||
| Red Hat Enterprise Linux 7 | php | Out of support scope | ||
| Red Hat Enterprise Linux 8 | php:7.4/php | Not affected | ||
| Red Hat Enterprise Linux 8 | php:8.2/php | Not affected | ||
| Red Hat Enterprise Linux 9 | php | Not affected | ||
| Red Hat Enterprise Linux 9 | php:8.1/php | Not affected | ||
| Red Hat Enterprise Linux 9 | php:8.2/php | Not affected | ||
| Red Hat Enterprise Linux 10 | php | Fixed | RHSA-2025:7489 | 13.05.2025 |
| Red Hat Enterprise Linux 9 | php | Fixed | RHSA-2025:7418 | 13.05.2025 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.
In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.
In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code seq ...
Reference counting in php_request_shutdown causes Use-After-Free
Уязвимость функции php_request_shutdown интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код
EPSS
8.1 High
CVSS3