Red Hat Bugzilla – Bug 1120259
CVE-2014-4698 php: ArrayIterator use-after-free due to object change during sorting
Last modified: 2017-09-20 05:15:51 EDT
It was reported [1] that PHP incorrectly handled certain ArrayIterators. A local attacker, in particular shared hosting environments relying on PHP features such as open_basedir, safe_mode, disable_functions, and similar), could use this flaw to cause PHP to crash, resulting in a denial of service. [1] https://bugs.php.net/bug.php?id=67539
I'm not convinced this is something that should have ever gotten a CVE. There is a reproducer noted in the original bug report, and in order to see anything interesting, you need to run it under valgrind, but even then with a certain environment variable set (that twiddles with memory handling? It's USE_ZEND_ALLOC=0). When run without valgrind, I don't see the script dying, and I tried with php53 on RHEL5 and php on RHEL6. With php on RHEL7 is does complain that it ran out of memory (Allowed memory exhausted). But the upstream bug report indicates: """ Please use CVE-2014-4698, the bug is in fact exploitable - not sure why was it made public before release of a patched version. It's not remotely exploitable, however, shared environments relying on PHP security features (open_basedir, safe_mode in older PHPs, disable_functions and similar) are affected. We're ready to provide PoC is needed. """ So you run a custom PHP script to cause PHP to crash, locally, from the command-line. You can do that a hundred and one other ways too. Perhaps I'm missing something?
Oh, forgot to note the fix: http://git.php.net/?p=php-src.git;a=commit;h=22882a9d89712ff2b6ebc20a689a89452bba4dcd
rhel5/php is not affected (PHP 5.1 doesn't have the unserialize method for the ArrayIterator class)
IssueDescription: A use-after-free flaw was found in the way PHP handled certain ArrayIterators. A malicious script author could possibly use this flaw to disclose certain portions of server memory.
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 5 Via RHSA-2014:1326 https://rhn.redhat.com/errata/RHSA-2014-1326.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2014:1327 https://rhn.redhat.com/errata/RHSA-2014-1327.html
This issue has been addressed in the following products: Red Hat Software Collections 1 for Red Hat Enterprise Linux 7 Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6 Via RHSA-2014:1766 https://rhn.redhat.com/errata/RHSA-2014-1766.html
This issue has been addressed in the following products: Red Hat Software Collections 1 for Red Hat Enterprise Linux 7 Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6 Via RHSA-2014:1765 https://rhn.redhat.com/errata/RHSA-2014-1765.html
Statement: This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 5.