Bug 1359698 (CVE-2016-6289)

Summary: CVE-2016-6289 php: Integer overflow leads to buffer overflow in virtual_file_ex
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abhgupta, apmukher, dmcphers, fedora, hhorak, jialiu, jokerman, jorton, kseifried, lmeyer, mmccomas, rcollet, tiwillia, webstack-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: php 5.5.38, php 5.6.24, php 7.0.9 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-09-26 20:06:51 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1359837    
Bug Blocks: 1359830    

Description Adam Mariš 2016-07-25 10:19:56 UTC
An integer overflow vulnerability was found in CWD_API virtual_file_ex in php-src/Zend/zend_virtual_cwd.c that allows to memcpy a large chunk of memory leading to buffer overflow.

Upstream bug:

https://bugs.php.net/bug.php?id=72513

Upstream patch:

http://git.php.net/?p=php-src.git;a=commit;h=0218acb7e756a469099c4ccfb22bce6c2bd1ef87

CVE assignment:

http://seclists.org/oss-sec/2016/q3/137

Comment 1 Adam Mariš 2016-07-25 14:12:53 UTC
Created php tracking bugs for this issue:

Affects: fedora-all [bug 1359837]

Comment 2 Huzaifa S. Sidhpurwala 2016-08-04 06:14:54 UTC
Analysis:

This is a flaw in the Thread Safe Resource Manager virtual_file_ex() function of PHP, which is defined as:

CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func verify_path, int use_realpath)

Inside the function, path_length is calculated by using:

int path_length = (int)strlen(path);

So, if path variable is attacker controller, the attacker could give an extremely long path, which may cause the output of strlen to wrap, causing an integer overflow. Later in the function the following memcpy() is used.

memcpy(resolved_path , path, path_length + 1);

Depending on the value of path_length (because of the integer overflow), this may cause large chunk of data to copied into the stack based variable resolved_path, resulting in a possible crash.

As described in the upstream bug, one way to trigger this crash would be via a PHP zip handling functions. In the POC the following is used:

        $a->extractTo(".", str_repeat("/",0xfffffff0));

Here the path variable fed to virtual_file_ex is specially-crafted and can cause a crash.

So, this attack can only be triggered if the path variable can be in some way controlled by the attacker.

Comment 3 errata-xmlrpc 2016-11-15 11:43:08 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html