CVE-2024-8932

What it actually does

Uncontrolled long string inputs to ldap_escape() on 32-bit systems trigger an integer overflow that results in an out-of-bounds write.

Why it matters to the business

Legacy 32-bit PHP deployments using LDAP functions may experience application crashes or potential memory corruption, increasing risk to services that still run on older hardware or operating systems.

How an attack unfolds

An attacker supplies an excessively long string argument to ldap_escape() in a PHP application running on a 32-bit system; the integer overflow bypasses length checks and writes attacker-controlled data beyond allocated buffers.

How to fix it

Upgrade PHP to 8.1.31 or later, 8.2.26 or later, or 8.3.14 or later on all 32-bit systems. Apply the exact fixed commits listed for php/php-src and the corresponding Ubuntu chromium-browser patches where applicable.

How to confirm the fix worked

Verify the installed PHP version is at or above the fixed releases; run regression tests that exercise ldap_escape() with maximum-length inputs on 32-bit builds.

Typical attack path

1. Identify a PHP application that calls ldap_escape() with user-controlled input
2. Craft a string longer than 2^31-1 bytes to trigger the 32-bit integer overflow
3. Trigger the vulnerable code path to cause the out-of-bounds write
4. Leverage the resulting memory corruption for denial of service or further exploitation

How to detect it

Monitor application logs and core dumps for segmentation faults or abnormal memory access patterns around LDAP calls; correlate with web request logs showing unusually long parameters to ldap_escape().

What your security team should do

• Prioritize inventory of all 32-bit PHP installations and schedule upgrades within standard change windows
• Add version checks for PHP 8.1 < 8.1.31, 8.2 < 8.2.26, and 8.3 < 8.3.14 to continuous monitoring
• Review LDAP-related code for direct exposure of user input to ldap_escape()
• Plan migration off 32-bit platforms where feasible to eliminate the class of integer-overflow issues