A critical vulnerability, CVE-2023-3824, has been identified in certain PHP versions, affecting a wide range of systems. With a severity rating of 9.8 by NIST and 9.4 by the PHP Group, this vulnerability can potentially lead to memory corruption or remote code execution. Systems running PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 are at risk. The issue arises from insufficient length checking when loading a phar file, which may result in a stack buffer overflow. Users are advised to update their PHP installations to mitigate the risk.

How do I know if I'm affected?

If you're using PHP and want to know if you're affected by the CVE-2023-3824 vulnerability, check your PHP version. Systems running PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 are at risk. To determine if you're affected, ensure you're not using a vulnerable PHP version and be cautious when loading phar files.

What should I do if I'm affected?

If you're affected by the CVE-2023-3824 vulnerability, update your PHP installation to a secure version (8.0.30, 8.1.22, or 8.2.8 and later). This will help prevent memory corruption or remote code execution. Avoid opening untrusted phar files and consider contacting your software provider for additional support.

Is CVE-2023-3824 in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-3824 vulnerability is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. This PHP-related vulnerability was added on August 11, 2023. There is no specific due date or required action mentioned, but updating your PHP installation to a secure version (8.0.30, 8.1.22, or 8.2.8 and later) is recommended to prevent potential memory corruption or remote code execution.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-119 is related to improper restriction of operations within memory buffers, which can lead to memory corruption or remote code execution when loading a phar file in certain PHP versions. This issue is associated with multiple weaknesses, including buffer overflows and overreads.

For more details

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD or the resources listed below.

• GitHub Advisory: Buffer overflow and overread in phar\_dir\_read()

• Debian LTS Advisory DLA-3555-1: php7.3 security update

• Fedora Mailing Lists: Fedora 38 Update: php-8.2.9-2.fc38

• NetApp Security Advisory: August 2023 PHP Vulnerabilities in NetApp Products