Bug 1351173 (CVE-2016-5771)

Summary:	CVE-2016-5771 php: Use After Free Vulnerability in PHP's GC algorithm and unserialize
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abhgupta, dmcphers, fedora, hhorak, jialiu, jokerman, jorton, kseifried, lmeyer, mmccomas, rcollet, sardella, tiwillia, webstack-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	php 5.5.37, php 5.6.23	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-07-27 05:35:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1351180
Bug Blocks:	1351183

Description Andrej Nemec 2016-06-29 11:57:49 UTC

A  use after free vulnerability was discovered when PHP's garbage collection algorithm interacts with other specific PHP objects. This vulnerability has wide reaching effects like allowing the exploitation of unserialize to gain remote code execution on a target system.

Upstream bug:

https://bugs.php.net/bug.php?id=72433

Upstream patch:

http://git.php.net/?p=php-src.git;a=commitdiff;h=3f627e580acfdaf0595ae3b115b8bec677f203ee

CVE assignment:

http://seclists.org/oss-sec/2016/q2/589

Comment 1 Andrej Nemec 2016-06-29 12:05:21 UTC

Created php tracking bugs for this issue:

Affects: fedora-all [bug 1351180]

Comment 2 Fedora Update System 2016-07-02 15:27:08 UTC

php-5.6.23-1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2016-07-02 19:21:57 UTC

php-5.6.23-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2016-07-02 19:27:16 UTC

php-5.6.23-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 7 Huzaifa S. Sidhpurwala 2016-07-27 05:35:20 UTC

This issue happens when untrusted input is unserialized.  Doing so it documented as being unsafe:

  http://php.net/manual/en/function.unserialize.php

  Do not pass untrusted user input to unserialize(). Unserialization can
  result in code being loaded and executed due to object instantiation and
  autoloading, and a malicious user may be able to exploit this. Use a safe,
  standard data interchange format such as JSON (via json_decode() and
  json_encode()) if you need to pass serialized data to the user.

Comment 8 Tomas Hoger 2016-07-27 12:51:14 UTC

More details about this issue can be found in:

https://www.evonide.com/breaking-phps-garbage-collection-and-unserialize/

Comment 9 errata-xmlrpc 2016-11-15 11:41:57 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html