REDHAT-BUG-2468563: Use After Free
In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, when SoapServer is configured with SOAPPERSISTENCESESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PHP SoapServerto a version that resolves this vulnerability.Fixed in 8.2.31 - Upgrade
Upgrade
PHP SoapServerto a version that resolves this vulnerability.Fixed in 8.3.31 - Upgrade
Upgrade
PHP SoapServerto a version that resolves this vulnerability.Fixed in 8.4.21 - Upgrade
Upgrade
PHP SoapServerto a version that resolves this vulnerability.Fixed in 8.5.6 - Configuration
If SoapServer is configured with SOAP_PERSISTENCE_SESSION, change the SoapServer persistence configuration to avoid SOAP_PERSISTENCE_SESSION, since in affected PHP versions it persists the handler object via session storage and can lead to use-after-free.
PHP SoapServer SOAP_PERSISTENCE_SESSION = do not use SOAP_PERSISTENCE_SESSION (use without session persistence instead)
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2468563?
The severity of REDHAT-BUG-2468563 is classified as medium, rated at 4.
What versions of PHP are affected by REDHAT-BUG-2468563?
REDHAT-BUG-2468563 affects PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6.
How do I fix REDHAT-BUG-2468563?
To fix REDHAT-BUG-2468563, upgrade to the latest version of PHP that is not affected by this vulnerability.
What vulnerability type is REDHAT-BUG-2468563 categorized under?
REDHAT-BUG-2468563 is categorized under Use After Free vulnerabilities.
How does REDHAT-BUG-2468563 impact SoapServer?
REDHAT-BUG-2468563 impacts SoapServer by allowing handler objects to persist across requests, which can lead to potential session-based exploits in case of SOAP request errors.