CVE Vulnerabilities

CVE-2021-21708

Use After Free

Published: Feb 27, 2022 | Modified: Nov 21, 2024
CVSS 3.x
9.8
CRITICAL
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
9.8 IMPORTANT
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Name Vendor Start Version End Version
Php Php 7.4.0 (including) 7.4.28 (excluding)
Php Php 8.0.0 (including) 8.0.16 (excluding)
Php Php 8.1.0 (including) 8.1.3 (excluding)
Red Hat Enterprise Linux 8 RedHat php:8.0-8070020220801083134.afd00e68 *
Red Hat Enterprise Linux 8 RedHat php:7.4-8070020220707122009.afd00e68 *
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support RedHat php:7.4-8040020250311105031.d7c09045 *
Red Hat Enterprise Linux 8.4 Telecommunications Update Service RedHat php:7.4-8040020250311105031.d7c09045 *
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions RedHat php:7.4-8040020250311105031.d7c09045 *
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support RedHat php:7.4-8060020250311104929.5caa48ff *
Red Hat Enterprise Linux 8.6 Telecommunications Update Service RedHat php:7.4-8060020250311104929.5caa48ff *
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions RedHat php:7.4-8060020250311104929.5caa48ff *
Red Hat Enterprise Linux 9 RedHat php-0:8.0.20-3.el9 *
Php5 Ubuntu trusty *
Php7.0 Ubuntu xenial *
Php7.4 Ubuntu esm-infra/focal *
Php7.4 Ubuntu focal *
Php7.4 Ubuntu upstream *
Php8.0 Ubuntu impish *
Php8.1 Ubuntu devel *
Php8.1 Ubuntu jammy *
Php8.1 Ubuntu upstream *

Potential Mitigations

References