CVE-2024-11235: Reference counting in php_request_shutdown causes Use-After-Free
Fixed (Reference counting in phprequestshutdown causes Use-After-Free). (CVE-2024-11235)
Other sources
In PHP versions 8.3. before 8.3.19 and 8.4. before 8.4.5, a code sequence involving set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.4.5 - Upgrade
Upgrade
debian/php8.4to a version that resolves this vulnerability.Fixed in 8.4.5-1 - Upgrade
Upgrade
debian/php8.4to a version that resolves this vulnerability.Fixed in 8.4.24-1~deb13u1Fixed in 8.4.27-1~deb13u1Fixed in 8.4.27-1 - Upgrade
Upgrade
alpine/php83to a version that resolves this vulnerability.Fixed in 8.3.18-r0 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.3.19
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11235?
CVE-2024-11235 has been classified as a critical vulnerability due to its potential for causing use-after-free errors.
How do I fix CVE-2024-11235?
To fix CVE-2024-11235, upgrade PHP to version 8.3.19 or later.
What causes the vulnerability CVE-2024-11235?
The vulnerability CVE-2024-11235 is caused by improper reference counting during the php_request_shutdown process.
Which versions of PHP are affected by CVE-2024-11235?
CVE-2024-11235 affects all PHP versions prior to 8.3.19.
Is there a workaround for CVE-2024-11235?
There is no known workaround for CVE-2024-11235; upgrading to a fixed version is the only solution.