Created php tracking bugs for this issue:

Affects: fedora-all [bug 1359837]

Analysis:

This is a flaw in the Thread Safe Resource Manager virtual_file_ex() function of PHP, which is defined as:

CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func verify_path, int use_realpath)

Inside the function, path_length is calculated by using:

int path_length = (int)strlen(path);

So, if path variable is attacker controller, the attacker could give an extremely long path, which may cause the output of strlen to wrap, causing an integer overflow. Later in the function the following memcpy() is used.

memcpy(resolved_path , path, path_length + 1);

Depending on the value of path_length (because of the integer overflow), this may cause large chunk of data to copied into the stack based variable resolved_path, resulting in a possible crash.

As described in the upstream bug, one way to trigger this crash would be via a PHP zip handling functions. In the POC the following is used:

        $a->extractTo(".", str_repeat("/",0xfffffff0));

Here the path variable fed to virtual_file_ex is specially-crafted and can cause a crash.

So, this attack can only be triggered if the path variable can be in some way controlled by the attacker.

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html