Bug 1120266 (CVE-2014-4670)

Similar to bug #1120259 I'm not convinced this is something that should have ever gotten a CVE.  There is a reproducer noted in the original bug report and it doesn't crash with php53 on RHEL5, php on RHEL6, or php on RHEL7.

The upstream bug report indicates:

"""
Please use CVE-2014-4670, the bug is in fact exploitable - not sure why was it made public before release of a patched version.

It's not remotely exploitable, however, shared environments relying on PHP security features (open_basedir, safe_mode in older PHPs, disable_functions and similar) are affected. We're ready to provide PoC is needed.
"""

So you run a custom PHP script to cause PHP to crash, locally, from the command-line.  You can do that a hundred and one other ways too.

It's possible that, like the other bug, I'm missing something but I'm not sure why this is being given a CVE (although, in fairness, some of our protections may be interfering here and a "vanilla" PHP on some other OS may have undesirable affects).

Hello Vincent,

our research team originally reported this bug - so let me put some more light onto the problem.

The bug nature is use-after-free - there are a couple of wrong reads and writes if you run it in valgrind - it does not generate segfault every time.

It's not just a DoS bug as noted here: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-4670 .. as that's completely useless as you said - you'd just crash an ie. apache child running that PHP process and cause exactly nothing.

It's however also a "or possibly have unspecified other impact" thing.

The use-after-free also allows (after some heap-spraying and putting objects correctly onto the heap) to read and write arbitrary memory of the PHP process.

That is why we said that "shared environments relying on PHP security features (open_basedir, safe_mode in older PHPs, disable_functions and similar) are affected."

Simply because using this (also the other one + tons of other similar bugs in PHP) you can disable open_basedir, safe_mode, re-enable disable_functions and do basically anything PHP has implemented as protection measure .. and after you've done so (as noted - if the shared hosting rely only on PHP protections) ie. browse through hundreds of applications hosted on the same host.

Same applies for the other bug (CVE-2014-4698). I hope this explains why this should have gotten a CVE.

I'm not even gonna start on why PHP team made these issues public as the first thing after we reported them with "Security" tag.

Lukas

Hi, Lukas.  Thanks for this additional information.

If the only real issue here is with environments using safe_mode, etc. for a "secure PHP environment" then we have stated repeatedly in the past that the bypass of those protections is not something we consider security-relevant as per bug #169857.

Someone will be reviewing this further, however, to see if there is some relevance outside of those types of quasi-protections (i.e. a real use-case that doesn't factor safe_mode/etc into consideration as we don't believe, and neither does upstream, that those are real security mechanisms).

rhel5/php is not affected (PHP 5.1 doesn't have the SplDoublyLinkedList class)

IssueDescription:

A use-after-free flaw was found in the way PHP handled certain Standard PHP Library (SPL) Iterators. A malicious script author could possibly use this flaw to disclose certain portions of server memory.

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5

Via RHSA-2014:1326 https://rhn.redhat.com/errata/RHSA-2014-1326.html

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:1327 https://rhn.redhat.com/errata/RHSA-2014-1327.html

This issue has been addressed in the following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6

Via RHSA-2014:1766 https://rhn.redhat.com/errata/RHSA-2014-1766.html

This issue has been addressed in the following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6

Via RHSA-2014:1765 https://rhn.redhat.com/errata/RHSA-2014-1765.html

Statement:

This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 5.