Bug 1187225 (CVE-2015-8382)

Summary:	CVE-2015-8382 php: Regular Expression Uninitialized Pointer Information Disclosure Vulnerability (ZDI-CAN-2547)
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	bleanhar, bressers, carnil, ccoleman, dmcphers, fedora, jdetiber, jialiu, jkeck, jokerman, jorton, jrusnack, kseifried, lmeyer, mmaslano, mmccomas, rcollet, sardella, security-response-team, slawomir, webstack-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-08-04 06:31:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1161587, 1249905, 1249906
Bug Blocks:	1161143

Description Vasyl Kaigorodov 2015-01-29 15:14:32 UTC

It was reported that pcre_exec in PHP pcre extension partially initialize a buffer when an invalid regex is processed, which can information disclosure.

A mitigation fix have been applied in PHP 5.4+
http://git.php.net/?p=php-src.git;a=commitdiff;h=c351b47ce85a3a147cfa801fa9f0149ab4160834

Upstream bug report (with a patch proposal):
http://bugs.exim.org/show_bug.cgi?id=1537

Comment 2 Huzaifa S. Sidhpurwala 2015-08-04 05:39:16 UTC

The upstream PCRE bug contains detailed description of the issue along with a possible way to reproduce this way:

https://bugs.exim.org/show_bug.cgi?id=1537

From the analysis it seems that the maximum impact of this flaw is memory disclosure, which could be an issue specially when pcre is used in web browsers or other similar products, specially when the disclosed memory is recoverable by the attackers.

This patch has been committed upstream via:

http://vcs.pcre.org/pcre/code/trunk/pcre_exec.c?r1=1502&r2=1510

And is a part of upstream release pcre-8.37

CVE Request:
http://openwall.com/lists/oss-security/2015/08/04/2

Comment 3 Huzaifa S. Sidhpurwala 2015-08-04 06:25:19 UTC

Note:

This flaw is related to bad regex code and does not require malicious user-input to trigger.

Comment 4 Huzaifa S. Sidhpurwala 2015-08-04 06:28:00 UTC

Created mingw-pcre tracking bugs for this issue:

Affects: fedora-all [bug 1249905]

Comment 5 Huzaifa S. Sidhpurwala 2015-08-04 06:28:34 UTC

Created pcre tracking bugs for this issue:

Affects: fedora-21 [bug 1249906]