| |
PHP contains various global state, such as error, session, object and extension state that is retained by a worker but points to memory owned by one request. That state must be reset before the request memory is released. Some input, configuration, session and error handling operations run before normal initialization of the next request. They inadvertently access stale state not reset by the previous request before initialization has a chance to replace it, causing a use after free. A strategically crafted heap layout can produce full remote code execution (RCE). |
| - |
|
| - |
State can survive for more than one reason. A fatal error, including one caused by memory exhaustion, can abandon an operation before it performs its matching reset. A warning or other nonfatal diagnostic can also repopulate error state after that state was already cleared during shutdown. The request heap is then freed while the worker global field still refers to it. A later operation that runs before normal request initialization can consume the stale value. |
| - |
|
| - |
Successful exploitation of this vulnerability requires both a producer and a consumer. The producer is a PHP operation that stores state owned by one request in a location PHP can access later in a subsequent request. The consumer is a subsequent PHP operation that reads, frees, branches or otherwise acts on the stale state previously stored by the producer. |
| - |
|
| - |
A concrete vulnerability would arise under the following conditions: |
| - |
|
| - |
A reachable PHP operation stores request-owned state in a globally accessible location, acting as the producer. |
| - |
The state is not reset, or another operation repopulates it after its normal reset. |
| - |
PHP releases the request memory while the persistent worker retains the referring global state. |
| - |
The same worker handles another request. |
| - |
A PHP operation reads, frees, branches or otherwise acts on the stale state before normal request initialization resets it, acting as the consumer. |
| - |
The demonstrated producing and consuming operations occur in different HTTP requests handled by the same worker. The exact affected versions, configuration and mitigations depend on the internal state affected by the producing operation. |