Bug 1323118 (CVE-2015-8865)

Summary:	CVE-2015-8865 file: Buffer over-write in finfo_open with malformed magic file
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	abhgupta, carnil, dmcphers, jialiu, jokerman, jorton, kseifried, lmeyer, mmaslano, mmccomas, rcollet, sardella, security-response-team, slawomir, tiwillia
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	file 5.23, php 5.5.34, php 5.6.20, php 7.0.5	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-05-30 10:48:05 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1323712
Bug Blocks:	1323121, 1323711

Description Adam Mariš 2016-04-01 10:20:53 UTC

Buffer over-write vulnerability in finfo_open triggered by malformed magic file was found, causing segfault when running with environment variable USE_ZEND_ALLOC set to 0, and also when compiled with ASAN with USE_ZEND_ALLOC set and unset.

This issue was fixed in file-5.23.

Upstream bug (contains reproducer):

http://bugs.gw.com/view.php?id=522

PHP bug:

https://bugs.php.net/bug.php?id=71527

Upstream patch:

https://github.com/file/file/commit/6713ca45e7757297381f4b4cdb9cf5e624a9ad36
https://git.php.net/?p=php-src.git;a=commit;h=fe13566c93f118a15a96320a546c7878fd0cfc5e

Comment 2 Adam Mariš 2016-04-04 13:34:37 UTC

Created php tracking bugs for this issue:

Affects: fedora-all [bug 1323712]

Comment 3 Fedora Update System 2016-04-09 14:21:32 UTC

php-5.6.20-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2016-04-09 14:22:59 UTC

php-5.6.20-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 6 Stefan Cornelius 2016-05-10 08:43:12 UTC

Mitigation:

Do not use untrusted magic files.

Comment 7 Tomas Hoger 2016-05-30 10:48:05 UTC

Magic file is really a configuration file for file/libmagic.  The use of untrusted magic file is unlikely, the typical use of file is to identify types of (possibly untrusted) files using fully trusted magic files.  In any typical use case, this does not cross any trust boundary and hence the fix is not planned to be backported as security fix to already released Red Hat products.

Comment 8 errata-xmlrpc 2016-11-15 11:51:02 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html