CVE-2023-0568
When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.
- CVSS 3.1
- 8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.24% probability · 68th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-131, CWE-770
- Affected
- php/php
- Source
- security@php.net
References
- https://bugs.php.net/bug.php?id=81746Exploit, Issue Tracking, Patch, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20230517-0001/
- https://bugs.php.net/bug.php?id=81746Exploit, Issue Tracking, Patch, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20230517-0001/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.