Bug 1260683 (CVE-2015-6836)

Summary: CVE-2015-6836 php: SOAP serialize_function_call() type confusion
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: bleanhar, ccoleman, dmasirka, dmcphers, erich, fedora, gscott, jdetiber, jialiu, jkeck, jokerman, jorton, kseifried, lmeyer, magoldma, mmaslano, mmccomas, rcollet, webstack-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=low,public=20150829,reported=20150904,source=internet,cvss2=5.1/AV:N/AC:H/Au:N/C:P/I:P/A:P,cwe=CWE-843,rhel-5/php=wontfix,rhel-5/php53=wontfix,rhel-6/php=wontfix,rhel-7/php=wontfix,rhscl-2/php54-php=wontfix,rhscl-2/php55-php=wontfix,rhscl-2/rh-php56-php=affected,fedora-all/php=affected
Fixed In Version: php 5.4.45, php 5.5.29, php 5.6.13 Doc Type: Bug Fix
Doc Text:
A flaw was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-10-09 21:18:08 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1260684, 1305854, 1305855    
Bug Blocks: 1260756, 1306180    

Description Adam Mariš 2015-09-07 12:49:34 UTC
A type confusion occurs within SOAP serialize_function_call due to an insufficient validation of the headers field. In the SoapClient's __call method, the verify_soap_headers_array check is applied only to headers retrieved from zend_parse_parameters; problem is that a few lines later, soap_headers could be updated or even replaced with values from the __default_headers object fields. 

Vulnerable code:

if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__default_headers", sizeof("__default_headers"), (void **) &tmp) == SUCCESS && Z_TYPE_PP(tmp) == IS_ARRAY) {
2913        HashTable *default_headers = Z_ARRVAL_P(*tmp);
2914        if (soap_headers) {
2915            if (!free_soap_headers) {
2916                HashTable *t =  emalloc(sizeof(HashTable));
2917                zend_hash_init(t, 0, NULL, ZVAL_PTR_DTOR, 0);
2918                zend_hash_copy(t, soap_headers, (copy_ctor_func_t) zval_add_ref, NULL, sizeof(zval *));
2919                soap_headers = t;
2920                free_soap_headers = 1;
2921            }
2922            zend_hash_internal_pointer_reset(default_headers);
2923            while (zend_hash_get_current_data(default_headers, (void**)&tmp) == SUCCESS) {
2924                Z_ADDREF_PP(tmp);
2925                zend_hash_next_index_insert(soap_headers, tmp, sizeof(zval *), NULL);
2926                zend_hash_move_forward(default_headers);
2927            }
2928        } else {
2929            soap_headers = Z_ARRVAL_P(*tmp);
2930            free_soap_headers = 0;
2931        }

In such case, the soap_headers array is no longer assured to be holding Objects only, thus leading to a type confusion when serialize_function_call will try to access its elements through

4351    HashTable *ht = Z_OBJPROP_PP(header);

Upstream report:


Upstream patch:


Comment 1 Adam Mariš 2015-09-07 12:50:04 UTC
Created php tracking bugs for this issue:

Affects: fedora-all [bug 1260684]

Comment 2 Adam Mariš 2015-09-09 08:43:11 UTC
CVE assignment:


Comment 3 Fedora Update System 2015-09-14 22:19:43 UTC
php-5.6.13-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2015-09-14 23:18:43 UTC
php-5.6.13-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2015-09-18 18:41:11 UTC
php-5.6.13-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 6 Tomas Hoger 2015-10-09 20:46:33 UTC
This issue happens when untrusted input is unserialized.  Doing so it documented as being unsafe:


  Do not pass untrusted user input to unserialize(). Unserialization can
  result in code being loaded and executed due to object instantiation and
  autoloading, and a malicious user may be able to exploit this. Use a safe,
  standard data interchange format such as JSON (via json_decode() and
  json_encode()) if you need to pass serialized data to the user.

Comment 7 Tomas Hoger 2015-10-09 20:48:54 UTC
Affected code is part of the SOAP extension.  In Red Hat products, this extension is packaged separately in the php-soap subpackages.  Systems without php-soap installed can not be affected by this issue.  Removal of the package can be used to mitigate the issue on systems that do not require SOAP extension.

Comment 8 Tomas Hoger 2015-10-09 21:18:08 UTC
This issue affects PHP packages in Red Hat Enterprise Linux 5, 6 and 7, and Red Hat Software Collections.  As it is triggered by unserializing untrusted inputs, which is documented as being unsafe, there is currently no plan to backport the fix.  Future product updates may correct this issue if they rebase PHP packages to newer upstream version.


Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Comment 11 errata-xmlrpc 2016-03-15 20:57:38 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6

Via RHSA-2016:0457 https://rhn.redhat.com/errata/RHSA-2016-0457.html