CVE-2021-21708: UAF due to php_filter_float() failing

Modified

AliasesSUSE-SU-2022:0654-1SUSE-SU-2022:0847-1RHSA-2025:3016+8 more

Published 27-02-2022Last modified 17-09-2024

Vulnerability summary

CVE-2021-21708 is a critical (CVSS 9.8) Use After Free vulnerability in php group php. EPSS estimates a 3.00% chance of exploitation in the next 30 days, higher than 87.3% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (NVD)

EPSS score

3.00%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 7 · Related 3

DSA-5082-1 RHSA-2022:7624 RHSA-2022:7628 RHSA-2022:8197 SUSE-SU-2022:3997-1 SUSE-SU-2022:4068-1+1 more

Timeline

27-02-2022
PublishedVulnerability first disclosed.
17-09-2024
Last modifiedVulnerability information updated.

Description

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.

CVSS metrics

7 scores · 6 sources · 2 versions

v3.19.8v2.06.8

EPSS trend

Probability

3.00%

Chance of exploitation in the next 30 days

Percentile

87%

Versus all other CVEs

30-day change

No change 0.00 pp

From 3.00% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugs.php.net)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat75 products

apcu-panel< 0:5.1.18-1.module+el8.3.0+6678+b09f589e
libzip< 0:1.6.1-1.module+el8.3.0+6678+b09f589e
libzip-debuginfo< 0:1.6.1-1.module+el8.3.0+6678+b09f589e
libzip-debugsource< 0:1.6.1-1.module+el8.3.0+6678+b09f589e
libzip-devel< 0:1.6.1-1.module+el8.3.0+6678+b09f589e

libzip-tools< 0:1.6.1-1.module+el8.3.0+6678+b09f589e
libzip-tools-debuginfo< 0:1.6.1-1.module+el8.3.0+6678+b09f589e
php< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-bcmath< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-bcmath-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-cli< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-cli-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-common< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-common-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-dba< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-dba-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-dbg< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-dbg-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-debugsource< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-devel< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-embedded< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-embedded-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-enchant< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-enchant-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-ffi< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-ffi-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-fpm< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-fpm-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-gd< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-gd-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-gmp< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-gmp-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-intl< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-intl-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-json< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-json-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-ldap< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-ldap-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-mbstring< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-mbstring-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-mysqlnd< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-mysqlnd-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-odbc< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-odbc-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-opcache< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-opcache-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-pdo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-pdo-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-pear< 1:1.10.13-1.module+el8.6.0+16577+0788886f | < 1:1.10.13-1.module+el8.4.0+16578+ed65e99e
php-pecl-apcu< 0:5.1.18-1.module+el8.3.0+6678+b09f589e
php-pecl-apcu-debuginfo< 0:5.1.18-1.module+el8.3.0+6678+b09f589e
php-pecl-apcu-debugsource< 0:5.1.18-1.module+el8.3.0+6678+b09f589e
php-pecl-apcu-devel< 0:5.1.18-1.module+el8.3.0+6678+b09f589e
php-pecl-rrd< 0:2.0.1-1.module+el8.3.0+6678+b09f589e
php-pecl-rrd-debuginfo< 0:2.0.1-1.module+el8.3.0+6678+b09f589e
php-pecl-rrd-debugsource< 0:2.0.1-1.module+el8.3.0+6678+b09f589e
php-pecl-xdebug< 0:2.9.5-1.module+el8.3.0+6678+b09f589e
php-pecl-xdebug-debuginfo< 0:2.9.5-1.module+el8.3.0+6678+b09f589e
php-pecl-xdebug-debugsource< 0:2.9.5-1.module+el8.3.0+6678+b09f589e
php-pecl-zip< 0:1.18.2-1.module+el8.3.0+6678+b09f589e
php-pecl-zip-debuginfo< 0:1.18.2-1.module+el8.3.0+6678+b09f589e
php-pecl-zip-debugsource< 0:1.18.2-1.module+el8.3.0+6678+b09f589e
php-pgsql< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-pgsql-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-process< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-process-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-snmp< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-snmp-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-soap< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-soap-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-xml< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-xml-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-xmlrpc< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1
php-xmlrpc-debuginfo< 0:7.4.19-4.module+el8.6.0+22924+d3a53e75.1 | < 0:7.4.6-5.module+el8.4.0+22918+4f86939b.1

Show all 75

Suse13 products

php74&distro=SUSE Linux Enterprise Module for Web and Scripting 12< 7.4.6-1.36.1
php74&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 7.4.6-1.36.1
php7&distro=SUSE Enterprise Storage 7< 7.4.6-3.35.1
php7&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS< 7.4.6-3.35.1
php7&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 7.4.6-3.35.1

Show all 13

Opensuse4 products

php7-test&distro=openSUSE Leap 15.3< 7.4.6-3.35.1
php7&distro=openSUSE Leap 15.3< 7.4.6-3.35.1
php7&distro=openSUSE Tumbleweed< 7.4.28-1.1
php8&distro=openSUSE Tumbleweed< 8.1.3-1.1

Alpine2 products

php7< 7.4.32-r0 | < 7.4.28-r0
php8< 8.0.16-r0

Ubuntu2 products

php7.4< 7.4.3-4ubuntu2.9
php8.1< 8.1.2-1ubuntu1

Debian1 product

php7.4< 7.4.28-1+deb11u1

Php1 product

php≥ 7.4.0, < 7.4.28 | ≥ 8.0.0, < 8.0.16 | ≥ 8.1.0, < 8.1.3

Php group1 product

php≥ 7.4.x, < 7.4.28 | ≥ 8.0.X, < 8.0.16 | ≥ 8.1.X, < 8.1.3

8 vendors · 99 products

References

24 links

bugs.php.net/bug.php?id=81708X Refsource MISCExploitIssue TrackingPatchVendor Advisory
security.netapp.com/advisory/ntap-20220325-0004/X Refsource CONFIRMThird Party Advisory
security.gentoo.org/glsa/202209-20Vendor AdvisoryX Refsource GENTOOThird Party Advisory
www.suse.com/support/update/announcement/2022/suse-su-20220654-1/Advisory
bugzilla.suse.com/1196252REPORT
www.suse.com/security/cve/CVE-2021-21708WEB
www.suse.com/support/update/announcement/2022/suse-su-20220847-1/Advisory
access.redhat.com/errata/RHSA-2025:3016Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2055879REPORT

Show all 24 references

security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3016.jsonAdvisory
access.redhat.com/security/cve/CVE-2021-21708REPORT
www.cve.org/CVERecord?id=CVE-2021-21708AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2021-21708AdvisoryOval
www.php.net/ChangeLog-7.phpARTICLEREPORT
access.redhat.com/errata/RHSA-2025:3076Advisory
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3076.jsonAdvisory
ubuntu.com/security/CVE-2021-21708REPORT
nakedsecurity.sophos.com/2022/02/18/irony-alert-php-fixes-security-flaw-in-input-validation-code/REPORT
www.php.net/ChangeLog-8.phpREPORT
ubuntu.com/security/notices/USN-5303-1Advisory
security-tracker.debian.org/tracker/CVE-2021-21708Advisory
lists.opensuse.org/archives/…Advisory
security.alpinelinux.org/vuln/CVE-2021-21708Advisory