Internet Bug Bounty · Report #672245

Use After Free in GC with Certain Destructors

Validstatus

mediumseverity

9 Nov 2020disclosed

How it was found

The bug submitted at: https://bugs.php.net/bug.php?id=72530 The fix committed at: http://git.php.net/?p=php-src.git;a=commit;h=60a7e60b61b8e4a3d455974c83f76a26546ce117

Impact

The bug can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely via PHP’s object deserializing. ex: unserialize/phar/session

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original