Vulnerability Name:

CVE-2021-21708 (CCN-221046)

Assigned:2021-01-04
Published:2022-01-30
Updated:2022-10-07
Summary:In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
CVSS v3 Severity:9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.8 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.2 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L)
7.4 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): Low
9.8 Critical (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.8 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
8.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:C/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Complete
Availibility (A): Partial
Vulnerability Type:CWE-416
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2021-21708

Source: CCN
Type: PHP Sec Bug #81708
#81708 UAF due to php_filter_float() failing for ints

Source: CONFIRM
Type: Exploit, Issue Tracking, Patch, Vendor Advisory
N/A

Source: XF
Type: UNKNOWN
php-cve202121708-code-exec(221046)

Source: CCN
Type: GITHub Web site
php-sigsegv

Source: GENTOO
Type: Third Party Advisory
GLSA-202209-20

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20220325-0004/

Source: CCN
Type: IBM Security Bulletin 6845928 (Spectrum Sentinel Anomaly Scan Engine)
Vulnerabilities in PHP may affect IBM Spectrum Sentinel Anomaly Scan Engine (CVE-2021-21703, CVE-2021-21708, CVE-2021-21707, CVE-2022-31629, CVE-2022-31628)

Source: CCN
Type: PHP Web site
PHP

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2021-21708

Vulnerable Configuration:Configuration 1:
  • cpe:/a:php:php:*:*:*:*:*:*:*:* (Version >= 8.1.0 and < 8.1.3)
  • OR cpe:/a:php:php:*:*:*:*:*:*:*:* (Version >= 8.0.0 and < 8.0.16)
  • OR cpe:/a:php:php:*:*:*:*:*:*:*:* (Version >= 7.4.0 and < 7.4.28)

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/a:redhat:enterprise_linux:9:*:*:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/a:redhat:enterprise_linux:9::appstream:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:php:php:7.4.0:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:8.0.0:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:8.1.0:-:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:8075
    P
    		apache2-mod_php7-7.4.33-150400.4.22.1 on GA media (Moderate)
    2023-06-12
    oval:com.redhat.rhsa:def:20228197
    P
    		RHSA-2022:8197: php security, bug fix, and enhancement update (Moderate)
    2022-11-15
    oval:com.redhat.rhsa:def:20227624
    P
    		RHSA-2022:7624: php:8.0 security, bug fix, and enhancement update (Moderate)
    2022-11-08
    oval:com.redhat.rhsa:def:20227628
    P
    		RHSA-2022:7628: php:7.4 security, bug fix, and enhancement update (Moderate)
    2022-11-08
    oval:org.opensuse.security:def:3434
    P
    		apache2-mod_perl-2.0.8-11.43 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3540
    P
    		krb5-1.12.5-40.37.7 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:95170
    P
    		apache2-mod_php8-8.0.10-150400.2.8 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:95064
    P
    		apache2-mod_php7-7.4.25-150400.2.8 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:102103
    P
    		Security update for php7 (Important)
    2022-03-15
    oval:org.opensuse.security:def:119343
    P
    		Security update for php7 (Important)
    2022-03-15
    oval:org.opensuse.security:def:102283
    P
    		Security update for php7 (Important)
    2022-03-15
    oval:org.opensuse.security:def:119526
    P
    		Security update for php7 (Important)
    2022-03-15
    oval:org.opensuse.security:def:118848
    P
    		Security update for php7 (Important)
    2022-03-15
    oval:org.opensuse.security:def:1539
    P
    		Security update for php7 (Important)
    2022-03-15
    oval:org.opensuse.security:def:119711
    P
    		Security update for php7 (Important)
    2022-03-15
    oval:org.opensuse.security:def:119038
    P
    		Security update for php7 (Important)
    2022-03-15
    oval:org.opensuse.security:def:1725
    P
    		Security update for php7 (Important)
    2022-03-15
    oval:org.opensuse.security:def:5355
    P
    		Security update for php74 (Important)
    2022-03-01
    BACK
    php php *
    php php *
    php php *
    php php 7.4.0
    php php 8.0.0 -
    php php 8.1.0 -