UAF due to php_filter_float() failing
CVE-2021-21708

8.2HIGH

Key Information:

Vendor

PHP Group

Status
PHP
Vendor
CVE Published:
27 February 2022

What is CVE-2021-21708?

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.

Affected Version(s)

PHP 7.4.x < 7.4.28

PHP 8.0.X < 8.0.16

PHP 8.1.X < 8.1.3

References

https://bugs.php.net/bug.php?id=81708
x_refsource_MISC
https://security.netapp.com/advisory/ntap-20220325-0004/
x_refsource_CONFIRM
https://security.gentoo.org/glsa/202209-20
vendor-advisoryx_refsource_GENTOO

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dukk at softdev dot online
.
CVE-2021-21708 : UAF due to php_filter_float() failing