Hacker News Reader

Comment by smusamashah | Hacker News Reader

Someone is saying there is a new vulnerability that works on the newest 8.5.12 https://x.com/_annieversary/status/2112933589943742598

View on HN

That partial stack trace linked above seems to match this GitHub issue, which has much more information: https://github.com/php/php-src/issues/24488 (double-free introduced in 8.5.12)

From what I can see, this causes a crash only, and isn't weaponisable. It's a use-after-free, but the reclaim window is zero by construction.

This is false. Elise says:

11:12 UTC: “ERROR: AddressSanitizer: attempting double-free" from php 8.4.25”

11:44 UTC: “confirmed working on 8.5.10 too”

Thats before the 8.5.12 issue.

Mr. President...

... a second feline has hit the stack.

Is there anywhere good to get some sort of reliable stream of information about this possibility?

It's going to be pretty bad if we all panic to get the latest PHP up, and all confidently roll out our updated websites, just for them to still be vulnerable to something serious anyhow.

Anymore on this, I'm upgrading to 8.5.12 now and don't want to still be vulnerable?

This is why I like to have a minimum age requirement on package releases. Something like at least 2 or 3 days.

lol this is the exact scenario where that’s an well idea. Maybe the patch is bad, but not patching for 2 days means your guarantees to be hit by the original issue

We are damned if we don’t and (often times) damned if we do

To be clear they said it “still works” and “ ok thinking more about this, there's no way this is the same vuln, this is another one.”

Meaning this specific bug the parent comment is talking about is not new in just these patched versions from today.

So delaying your updates today would mean you’re exposed to an actively exploited RCE and still exposed to the other memory corruption bug (which may or may not be an easily exploitable RCE) for an entire 2 or 3 days.

And from the sounds of it people are very actively exploiting this so waiting 24+ hours will practically ensure you’re hit.

Reply on news.ycombinator.com