Bug 1260642 (CVE-2015-6834) - CVE-2015-6834 php: multiple unserialization use-after-free issues
Summary: CVE-2015-6834 php: multiple unserialization use-after-free issues
Status: CLOSED WONTFIX
Alias: CVE-2015-6834
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,public=20150731,reported=2...
Keywords: Security
: 1260695 1260707 (view as bug list)
Depends On: 1260648 1260649 1260650 1260651 1260652 1260653 1260654 1260655 1260656 1260657 1260658 1260660 1260661 1260662 1305854 1305855
Blocks: 1260756 1306180
TreeView+ depends on / blocked
 
Reported: 2015-09-07 12:13 UTC by Adam Mariš
Modified: 2019-06-08 20:44 UTC (History)
17 users (show)

(edit)
A flaw was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.
Clone Of:
(edit)
Last Closed: 2015-10-09 20:58:33 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:0457 normal SHIPPED_LIVE Moderate: rh-php56-php security update 2016-03-16 00:55:18 UTC

Description Adam Mariš 2015-09-07 12:13:31 UTC
Use after free vulnerability was found in unserialize() function. We can create ZVAL and free it via Serializable::unserialize. However the unserialize() will still allow to use R: or r: to set references to that already freed memory. It is possible to use-after-free attack and execute arbitrary code remotely.

Upstream bugs and patches:

https://bugs.php.net/bug.php?id=70172
http://git.php.net/?p=php-src.git;a=commitdiff;h=e8429400d40e3c3aa4b22ba701991d698a2f3b2f

https://bugs.php.net/bug.php?id=70366
http://git.php.net/?p=php-src.git;a=commitdiff;h=259057b2a484747a6c73ce54c4fa0f5acbd56179

https://bugs.php.net/bug.php?id=70365
http://git.php.net/?p=php-src.git;a=commitdiff;h=f06a069c462d37c2e009f6d1d93b8c8e7b713393

Comment 6 Adam Mariš 2015-09-07 12:23:13 UTC
Created php tracking bugs for this issue:

Affects: fedora-all [bug 1260662]

Comment 7 Adam Mariš 2015-09-09 08:00:09 UTC
*** Bug 1260707 has been marked as a duplicate of this bug. ***

Comment 8 Adam Mariš 2015-09-09 08:27:02 UTC
*** Bug 1260695 has been marked as a duplicate of this bug. ***

Comment 9 Adam Mariš 2015-09-09 08:29:43 UTC
CVE assignment:

http://seclists.org/oss-sec/2015/q3/524

Comment 10 Fedora Update System 2015-09-14 22:19:39 UTC
php-5.6.13-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2015-09-14 23:18:27 UTC
php-5.6.13-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2015-09-18 18:40:24 UTC
php-5.6.13-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 13 Tomas Hoger 2015-10-09 12:26:22 UTC
This issue happens when untrusted input is unserialized.  Doing so it documented as being unsafe:

  http://php.net/manual/en/function.unserialize.php

  Do not pass untrusted user input to unserialize(). Unserialization can
  result in code being loaded and executed due to object instantiation and
  autoloading, and a malicious user may be able to exploit this. Use a safe,
  standard data interchange format such as JSON (via json_decode() and
  json_encode()) if you need to pass serialized data to the user.

Comment 15 Tomas Hoger 2015-10-09 20:58:33 UTC
This issue did not affect PHP packages as shipped with Red Hat Enterprise Linux 6 and earlier.

As this problem is triggered by unserializing untrusted inputs, which is documented as being unsafe, there is currently no plan to backport the fix to PHP packages as shipped with Red Hat Enterprise Linux 7 and Red Hat Software Collections.  Future product updates may correct this issue if they rebase PHP packages to newer upstream version.

Statement:

This issue did not affect the versions of PHP as shipped with Red Hat Enterprise Linux 5 and 6.  This issue is not currently planned to be corrected in future updates in Red Hat Enterprise Linux 7 and Red Hat Software Collections.

Comment 18 errata-xmlrpc 2016-03-15 20:57:18 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6

Via RHSA-2016:0457 https://rhn.redhat.com/errata/RHSA-2016-0457.html


Note You need to log in before you can comment on or make changes to this bug.