Bug 1120259 (CVE-2014-4698)
| Summary: | CVE-2014-4698 php: ArrayIterator use-after-free due to object change during sorting | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Vincent Danen <vdanen> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | bleanhar, ccoleman, dmcphers, fedora, jdetiber, jialiu, jkeck, jokerman, jorton, jrusnack, kseifried, lmeyer, mmaslano, mmccomas, rcollet, webstack-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | php 5.5.15 | Doc Type: | Bug Fix |
| Doc Text: |
A use-after-free flaw was found in the way PHP handled certain ArrayIterators. A malicious script author could possibly use this flaw to disclose certain portions of server memory.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-10-31 10:00:19 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1114521, 1140017, 1140018, 1140023, 1140026, 1140027, 1149762, 1149771 | ||
| Bug Blocks: | 1120269, 1138881, 1149858 | ||
|
Description
Vincent Danen
2014-07-16 14:48:03 UTC
I'm not convinced this is something that should have ever gotten a CVE. There is a reproducer noted in the original bug report, and in order to see anything interesting, you need to run it under valgrind, but even then with a certain environment variable set (that twiddles with memory handling? It's USE_ZEND_ALLOC=0). When run without valgrind, I don't see the script dying, and I tried with php53 on RHEL5 and php on RHEL6. With php on RHEL7 is does complain that it ran out of memory (Allowed memory exhausted). But the upstream bug report indicates: """ Please use CVE-2014-4698, the bug is in fact exploitable - not sure why was it made public before release of a patched version. It's not remotely exploitable, however, shared environments relying on PHP security features (open_basedir, safe_mode in older PHPs, disable_functions and similar) are affected. We're ready to provide PoC is needed. """ So you run a custom PHP script to cause PHP to crash, locally, from the command-line. You can do that a hundred and one other ways too. Perhaps I'm missing something? Oh, forgot to note the fix: http://git.php.net/?p=php-src.git;a=commit;h=22882a9d89712ff2b6ebc20a689a89452bba4dcd rhel5/php is not affected (PHP 5.1 doesn't have the unserialize method for the ArrayIterator class) IssueDescription: A use-after-free flaw was found in the way PHP handled certain ArrayIterators. A malicious script author could possibly use this flaw to disclose certain portions of server memory. This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 5 Via RHSA-2014:1326 https://rhn.redhat.com/errata/RHSA-2014-1326.html This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2014:1327 https://rhn.redhat.com/errata/RHSA-2014-1327.html This issue has been addressed in the following products: Red Hat Software Collections 1 for Red Hat Enterprise Linux 7 Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6 Via RHSA-2014:1766 https://rhn.redhat.com/errata/RHSA-2014-1766.html This issue has been addressed in the following products: Red Hat Software Collections 1 for Red Hat Enterprise Linux 7 Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6 Via RHSA-2014:1765 https://rhn.redhat.com/errata/RHSA-2014-1765.html Statement: This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 5. |