Bug 1151423 (CVE-2014-3622)

Summary:	CVE-2014-3622 php: post handler potential illegal efree() vulnerability
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	bleanhar, ccoleman, dmcphers, fedora, jdetiber, jialiu, jkeck, joelsmith, jokerman, jorton, kseifried, lmeyer, mmaslano, mmccomas, mmcgrath, rcollet, redhat-bugzilla, webstack-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	php 5.6.1	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-10-21 10:43:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1149063, 1151427

Description Vasyl Kaigorodov 2014-10-10 11:22:15 UTC

It was found [1] that there's an issue in php which in some cases may lead to remote code execution.

[1]: https://bugs.php.net/bug.php?id=68088

Comment 1 Remi Collet 2014-10-10 11:34:20 UTC

As this require an extension doing bad things to be installed and enabled on the server side, I really think this is not a security issue (or a very very low one)

Comment 2 Vasyl Kaigorodov 2014-10-15 15:22:59 UTC

(In reply to Remi Collet from comment #1)
> As this require an extension doing bad things to be installed and enabled on
> the server side, I really think this is not a security issue (or a very very
> low one)

This one got a CVE, and that CVE got a CAT I IAVM: http://iasecontent.disa.mil/stigs/xls/iavm-to-cve%28u%29.xls

But you're right, reading the PHP bug:
...
However currently I am not aware of anything using input filters except for ext/filter and suhosin. Both are not doing anything to the value. But if there is some 3rd party possibly binary only filter extension out there that modifies
value it might result in a remotely exploitable problem for PHP 5.6+.
...

Setting Impact to Low.

Comment 3 Tomas Hoger 2014-10-21 10:43:37 UTC

Note that this is not really considered security flaw upstream (upstream bug type was changed from Security to Bug).  This can only be a problem if a filter extension attempts to free value passed to it.  No extensions are known to do that.

This issue was introduced upstream in the following commit:

http://git.php.net/?p=php-src.git;a=commitdiff;h=2438490#patch10

Prior to the above change, value was estrndup()ed before being passed to input filters.  Re-introduction of estrndup() is how the issue was fixed upstream:

http://git.php.net/?p=php-src.git;a=commitdiff;h=8d1099a

This change was applied in PHP version 5.6.1:

http://php.net/ChangeLog-5.php#5.6.1

Only PHP 5.6 versions were affected.  No Red Hat product currently ships PHP 5.6.  Older versions included in Red Hat products were not affected.

Statement:

Not vulnerable. This issue did not affect the versions of PHP as shipped with Red Hat Enterprise Linux 5, 6, and 7, and Red Hat Software Collections 1.

Comment 6 Tomas Hoger 2014-10-21 10:48:58 UTC

Released Fedora versions (up to 20 at the moment) also contain PHP 5.5.  Version 5.6 is only included in Rawhide / upcoming F21, and is already updated to 5.6.1.