Bug 1359698 (CVE-2016-6289)
Summary: | CVE-2016-6289 php: Integer overflow leads to buffer overflow in virtual_file_ex | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | abhgupta, apmukher, dmcphers, fedora, hhorak, jialiu, jokerman, jorton, kseifried, lmeyer, mmccomas, rcollet, tiwillia, webstack-team |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | php 5.5.38, php 5.6.24, php 7.0.9 | Doc Type: | If docs needed, set a value |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2016-09-26 20:06:51 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1359837 | ||
Bug Blocks: | 1359830 |
Description
Adam Mariš
2016-07-25 10:19:56 UTC
Created php tracking bugs for this issue: Affects: fedora-all [bug 1359837] Analysis: This is a flaw in the Thread Safe Resource Manager virtual_file_ex() function of PHP, which is defined as: CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func verify_path, int use_realpath) Inside the function, path_length is calculated by using: int path_length = (int)strlen(path); So, if path variable is attacker controller, the attacker could give an extremely long path, which may cause the output of strlen to wrap, causing an integer overflow. Later in the function the following memcpy() is used. memcpy(resolved_path , path, path_length + 1); Depending on the value of path_length (because of the integer overflow), this may cause large chunk of data to copied into the stack based variable resolved_path, resulting in a possible crash. As described in the upstream bug, one way to trigger this crash would be via a PHP zip handling functions. In the POC the following is used: $a->extractTo(".", str_repeat("/",0xfffffff0)); Here the path variable fed to virtual_file_ex is specially-crafted and can cause a crash. So, this attack can only be triggered if the path variable can be in some way controlled by the attacker. This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html |