Bug 1374699 (CVE-2016-7126)

Summary: CVE-2016-7126 php: select_colors write out-of-bounds
Product: [Other] Security Response Reporter: Martin Prpič <mprpic>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abhgupta, dmcphers, fedora, hhorak, jialiu, jokerman, jorton, kseifried, lmeyer, mmccomas, rcollet, tiwillia, webstack-team, yozone
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: php 5.6.25, php 7.0.10 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-10-20 05:44:07 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1374715    

Description Martin Prpič 2016-09-09 13:00:54 UTC 
The following flaw was found in PHP:

Type mismatch parameters between ncolors and colorsWanted parameters at zif_imagetruecolortopalette and php_gd_gdImageTrueColorToPalette, ncolors is a 64 bit integer and colorsWanted is 32 bits, ncolors' value 0x1000000000000000 becomes 0 inside php_gd_gdImageTrueColorToPalette.

A remote attacker could use this flaw to crash a PHP application.

Upstream bug:

https://bugs.php.net/bug.php?id=72697

Upstream patch:

https://github.com/php/php-src/commit/b6f13a5ef9d6280cf984826a5de012a32c396cd4?w=1
Comment 1 Huzaifa S. Sidhpurwala 2016-10-20 05:44:07 UTC 
Analysis:

This is basically an integer-wrapping which occurs because of type mismatch. User passes integer to imagetruecolortopalette() as per documentation (http://php.net/manual/en/function.imagetruecolortopalette.php), however when this function internally calls gdImageTrueColorToPalette(), its parameter colorsWanted is 32 bit, which later leads to OOB write.

To exploit this, the attacker needs to control the ncolors parameter in imagetruecolortopalette(), which is unlikely in case of an normal PHP application.
Comment 2 errata-xmlrpc 2016-11-15 11:45:09 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html