A flaw was found in PHP's error handling and worker process state management. PHP contains error handling, object, and extension state that is retained by the process but points to memory owned by a single request. A fatal error can interrupt an operation or cleanup phase before that state is reset. If PHP catches the failure and continues cleanup, or reuses the persistent worker for a subsequent request, a later operation may act on the stale state after its underlying memory has been released. An unauthenticated attacker can exploit this to achieve use-after-free and remote code execution against mod_php. FPM is conditionally affected through application-stage paths.
An unauthenticated remote attacker can trigger memory corruption leading to potential arbitrary code execution. In typical Red Hat Enterprise Linux deployments, PHP applications exposed to public networks handle incoming requests directly, so no prior authentication is needed to reach the vulnerable code. Exploitation requires hitting a precise out-of-memory condition during request processing, which keeps this below Critical.
See the security bulletin for a detailed mitigation procedure.
Bugzilla 2554177 : php: fatal error handling retains stale request state leading to use-after-free
CWE-416 : Use After Free
Common Vulnerability Scoring System (CVSS) Score Details
Info alert: Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications ).
CVSS v3 Score Breakdown
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD: CVSS:3.1 / AV:N / AC:L / PR:N / UI:N / S:U / C:H / I:H / A:H
Understanding the Weakness (CWE)
Technical Impact: Modify Memory
The use of previously freed memory may corrupt valid data, if the memory area in question has been allocated and used properly elsewhere.
Technical Impact: DoS: Crash, Exit, or Restart
If chunk consolidation occurs after the use of previously freed data, the process may crash when invalid data is used as chunk information.
Technical Impact: Read Memory
Read operations on freed memory can sometimes leak sensitive information instead of causing a crash
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If malicious data is entered before chunk consolidation can take place, it may be possible to take advantage of a write-what-where primitive to execute arbitrary code. If the newly allocated data happens to hold a class, in C++ for example, various function pointers may be scattered within the heap data. If one of these function pointers is overwritten with an address to valid shellcode, execution of arbitrary code can be achieved.
Frequently Asked Questions
"Under investigation" doesn't necessarily mean that the product is affected by this vulnerability. It only means that our Analysis Team is still working on determining whether the product is affected and how it is affected.
The term 'Affected' means that our Analysis team has determined that this product, such as Red Hat Enterprise Linux 8 or OpenShift Container Platform 4, is affected by this vulnerability and a fix may be released to address this issue in the near future. This includes all minor releases of this product unless noted otherwise in the Statement text.
Upgrade to a supported product version that includes a fix for this vulnerability (recommended).
Apply a mitigation (if one exists).
Customers with the Technical Account Manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.
Apply a mitigation (if one exists).
Red Hat Engineering focuses on addressing high-priority issues based on the impact and product lifecycle expectations. Therefore, lower-priority issues will not receive immediate fixes.
Customers with the technical account manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.
Not sure what something means? Check out our Security Glossary .
For clarification or corrections, please Red Hat Product Security .
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
