Niels Dossche

Several security issues were identified in PHP, a scripting language, potentially leading to denial of service or memory disclosure.

The issue is related to an integer overflow in the `ldap escape()` function on 32-bit systems when handling uncontrolled long string inputs. This can result in an out-of-bounds write, potentially allowing a remote attacker to execute arbitrary code by sending specially crafted data to a web application. The vulnerability is critical and can lead to system crashes or malicious actions.

The issue arises from incorrect handling of DOM processing instructions, allowing bypassing of the cross-site scripting mechanism of typo3/html-sanitizer.

The issue is caused by insufficient length checking when loading phar files, leading to a stack buffer overflow, which can result in memory corruption or remote code execution (RCE). This vulnerability was reportedly exploited by law enforcement agencies in Operation Cronos to compromise the LockBit ransomware group's infrastructure. The group claims that the vulnerability, specifically in PHP version 8.1.2, was used to gain access to their servers. It is estimated that over 2000 individuals and organizations have been affected by LockBit, with the group demanding over $91 million in ransom from American organizations alone. The vulnerability allows for RCE, which can enable attackers to execute arbitrary code on the affected system.

The issue is related to the use of a random value generator with a narrower range of values than it should have when using SOAP HTTP Digest Authentication. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce.

The issue is related to the core path resolution function in PHP, which allocates a buffer one byte too small. When resolving paths with lengths close to the system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with a NUL value, potentially resulting in unauthorized data access or modification.

A race condition issue has been identified in the Linux kernel, specifically in the IB/rdmavt module. The problem arises from a call to the `rvt error qp` function without proper locking, as required by the function's documentation. This can lead to a lockdep assertion failure and potentially cause a race condition. The issue is related to the `rvt ruc loopback` function, where the call to `rvt error qp` is no longer protected by the `r lock`.