Bug 1260647 (CVE-2015-6835) - CVE-2015-6835 php: use-after-free vulnerability in session deserializer
Summary: CVE-2015-6835 php: use-after-free vulnerability in session deserializer
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2015-6835
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1260665 1305854 1305855 1349597
Blocks: 1260756 1269194 1306180
TreeView+ depends on / blocked
 
Reported: 2015-09-07 12:21 UTC by Adam Mariš
Modified: 2019-10-10 10:10 UTC (History)
20 users (show)

Fixed In Version: php 5.4.45, php 5.5.29, php 5.6.13
Doc Type: Bug Fix
Doc Text:
A flaw was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.
Clone Of:
Environment:
Last Closed: 2015-10-09 20:58:58 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:0457 0 normal SHIPPED_LIVE Moderate: rh-php56-php security update 2016-03-16 00:55:18 UTC

Description Adam Mariš 2015-09-07 12:21:18 UTC 
A use-after-free vulnerability was found in session deserializer. When session deserializer (php/php_binary) is deserializing multiple data, it will call php_var_unserialize() multiple times. We can create ZVAL and free it via the php_var_unserialize() with a crafted serialized string. Then the next call php_var_unserialize() will still allow to use R: or r: to set references to that already freed memory. It is possible to use-after-free attack and execute arbitrary code remotely.

Upstream report:

https://bugs.php.net/bug.php?id=70219

Upstream patch:

http://git.php.net/?p=php-src.git;a=commitdiff;h=df4bf28f9f104ca3ef78ed94b497859f15b004e5
Comment 1 Adam Mariš 2015-09-07 12:24:46 UTC 
Created php tracking bugs for this issue:

Affects: fedora-all [bug 1260665]
Comment 2 Adam Mariš 2015-09-09 08:04:58 UTC 
CVE assignment:

http://seclists.org/oss-sec/2015/q3/524
Comment 3 Fedora Update System 2015-09-14 22:19:52 UTC 
php-5.6.13-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2015-09-14 23:18:46 UTC 
php-5.6.13-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2015-09-18 18:42:36 UTC 
php-5.6.13-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 10 Tomas Hoger 2015-10-09 12:43:50 UTC 
This issue happens when untrusted input is unserialized.  Doing so it documented as being unsafe:

  http://php.net/manual/en/function.unserialize.php

  Do not pass untrusted user input to unserialize(). Unserialization can
  result in code being loaded and executed due to object instantiation and
  autoloading, and a malicious user may be able to exploit this. Use a safe,
  standard data interchange format such as JSON (via json_decode() and
  json_encode()) if you need to pass serialized data to the user.
Comment 12 Tomas Hoger 2015-10-09 20:58:58 UTC 
As this problem is triggered by unserializing untrusted inputs, which is documented as being unsafe, there is currently no plan to backport the fix to PHP packages as shipped with Red Hat Enterprise Linux 6 and 7, and Red Hat Software Collections.  Future product updates may correct this issue if they rebase PHP packages to newer upstream version.
Comment 15 errata-xmlrpc 2016-03-15 20:57:28 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6

Via RHSA-2016:0457 https://rhn.redhat.com/errata/RHSA-2016-0457.html
Comment 16 Joe Orton 2016-07-28 08:30:07 UTC 
*** Bug 1349597 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.