Red Hat Bugzilla – Bug 1120266
CVE-2014-4670 php: SPL Iterators use-after-free
Last modified: 2017-09-20 05:15:51 EDT
It was reported [1] that PHP incorrectly handled certain SPL Iterators. A local attacker, in particular shared hosting environments relying on PHP features such as open_basedir, safe_mode, disable_functions, and similar), could use this flaw to cause PHP to crash, resulting in a denial of service. This has been fixed upstream [2]. [1] https://bugs.php.net/bug.php?id=67538 [2] http://git.php.net/?p=php-src.git;a=commit;h=df78c48354f376cf419d7a97f88ca07d572f00fb
Similar to bug #1120259 I'm not convinced this is something that should have ever gotten a CVE. There is a reproducer noted in the original bug report and it doesn't crash with php53 on RHEL5, php on RHEL6, or php on RHEL7. The upstream bug report indicates: """ Please use CVE-2014-4670, the bug is in fact exploitable - not sure why was it made public before release of a patched version. It's not remotely exploitable, however, shared environments relying on PHP security features (open_basedir, safe_mode in older PHPs, disable_functions and similar) are affected. We're ready to provide PoC is needed. """ So you run a custom PHP script to cause PHP to crash, locally, from the command-line. You can do that a hundred and one other ways too. It's possible that, like the other bug, I'm missing something but I'm not sure why this is being given a CVE (although, in fairness, some of our protections may be interfering here and a "vanilla" PHP on some other OS may have undesirable affects).
Hello Vincent, our research team originally reported this bug - so let me put some more light onto the problem. The bug nature is use-after-free - there are a couple of wrong reads and writes if you run it in valgrind - it does not generate segfault every time. It's not just a DoS bug as noted here: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-4670 .. as that's completely useless as you said - you'd just crash an ie. apache child running that PHP process and cause exactly nothing. It's however also a "or possibly have unspecified other impact" thing. The use-after-free also allows (after some heap-spraying and putting objects correctly onto the heap) to read and write arbitrary memory of the PHP process. That is why we said that "shared environments relying on PHP security features (open_basedir, safe_mode in older PHPs, disable_functions and similar) are affected." Simply because using this (also the other one + tons of other similar bugs in PHP) you can disable open_basedir, safe_mode, re-enable disable_functions and do basically anything PHP has implemented as protection measure .. and after you've done so (as noted - if the shared hosting rely only on PHP protections) ie. browse through hundreds of applications hosted on the same host. Same applies for the other bug (CVE-2014-4698). I hope this explains why this should have gotten a CVE. I'm not even gonna start on why PHP team made these issues public as the first thing after we reported them with "Security" tag. Lukas
Hi, Lukas. Thanks for this additional information. If the only real issue here is with environments using safe_mode, etc. for a "secure PHP environment" then we have stated repeatedly in the past that the bypass of those protections is not something we consider security-relevant as per bug #169857. Someone will be reviewing this further, however, to see if there is some relevance outside of those types of quasi-protections (i.e. a real use-case that doesn't factor safe_mode/etc into consideration as we don't believe, and neither does upstream, that those are real security mechanisms).
rhel5/php is not affected (PHP 5.1 doesn't have the SplDoublyLinkedList class)
IssueDescription: A use-after-free flaw was found in the way PHP handled certain Standard PHP Library (SPL) Iterators. A malicious script author could possibly use this flaw to disclose certain portions of server memory.
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 5 Via RHSA-2014:1326 https://rhn.redhat.com/errata/RHSA-2014-1326.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2014:1327 https://rhn.redhat.com/errata/RHSA-2014-1327.html
This issue has been addressed in the following products: Red Hat Software Collections 1 for Red Hat Enterprise Linux 7 Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6 Via RHSA-2014:1766 https://rhn.redhat.com/errata/RHSA-2014-1766.html
This issue has been addressed in the following products: Red Hat Software Collections 1 for Red Hat Enterprise Linux 7 Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 6 Via RHSA-2014:1765 https://rhn.redhat.com/errata/RHSA-2014-1765.html
Statement: This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 5.