Impact Analysis

The vulnerability can cause the PHP server to crash due to a null pointer dereference, resulting in segmentation faults. This affects the availability of the target server, potentially causing downtime or service interruptions.

Useful 0 Not Useful 0

Executive Summary

This vulnerability occurs in certain PHP versions when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled. If a prepared statement parameter contains an invalid character sequence (such as \x99), the quoting function PQescapeStringConn may return NULL. This causes a null pointer dereference in the pdo_parse_params() function, which can lead to crashes (segmentation faults) and affect the availability of the server.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update PHP to a fixed version: 8.1.34 or later for the 8.1 branch, 8.2.30 or later for the 8.2 branch, 8.3.29 or later for the 8.3 branch, 8.4.16 or later for the 8.4 branch, or 8.5.1 or later for the 8.5 branch. Alternatively, if updating is not immediately possible, disable PDO::ATTR_EMULATE_PREPARES when using the PDO PostgreSQL driver to avoid triggering the issue.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability leads to a denial of service (DoS) by causing crashes in the PHP process but does not result in loss of confidentiality or integrity. Therefore, it primarily affects availability. There is no direct indication that this vulnerability impacts compliance with standards like GDPR or HIPAA, which focus on data protection and privacy. However, availability issues could indirectly affect compliance if critical services are disrupted. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing if your PHP environment with the PDO PostgreSQL driver and PDO::ATTR_EMULATE_PREPARES enabled crashes when executing prepared statements containing invalid byte sequences such as "\x99". For example, you can run a PHP script that prepares and executes a statement with a parameter containing an invalid character sequence (e.g., "alice\x99"). If the PHP process crashes with a segmentation fault, it indicates the vulnerability is present. There are no specific network detection commands provided. To test locally, you can use a PHP script similar to: ```php $pdo = new PDO('pgsql:host=localhost;dbname=test', 'user', 'pass', [PDO::ATTR_EMULATE_PREPARES => true]); $stmt = $pdo->prepare('SELECT * FROM users WHERE name = ?'); $stmt->execute(["alice\x99"]); ``` If this causes a crash, the vulnerability exists. Additionally, checking your PHP version against the fixed versions (8.1.34, 8.2.30, 8.3.29, 8.4.16, 8.5.1) can help determine if you are vulnerable. [1]

Useful 0 Not Useful 0