Bug 1443487 – CVE-2017-6441 php: Null pointer dereference via crafted "declare(ticks="

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1443487 - (CVE-2017-6441) CVE-2017-6441 php: Null pointer dereference via crafted "declare(ticks="

Summary:	CVE-2017-6441 php: Null pointer dereference via crafted "declare(ticks="

Status:	CLOSED NOTABUG

Aliases:	CVE-2017-6441

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20170222,reported=2...
Keywords:	Security

Depends On:	1443534
Blocks:	1443491
	Show dependency tree / graph

Reported:	2017-04-19 06:56 EDT by Adam Mariš
Modified:	2017-04-27 01:26 EDT (History)
CC List:	8 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-04-27 01:25:39 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Adam Mariš 2017-04-19 06:56:52 EDT

The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of "declare(ticks=" in a PHP script.

Upstream issue:

https://github.com/php/php-src/pull/2396

Comment 1 Adam Mariš 2017-04-19 08:41:17 EDT

Created php tracking bugs for this issue:

Affects: fedora-all [bug 1443534]

Comment 2 Doran Moppert 2017-04-27 01:25:39 EDT

Upstream bug:

https://bugs.php.net/bug.php?id=74146

I agree with the vendor's assessment:  this is not a security issue.  It is a crash triggered by executing (essentially) arbitrary PHP code.  Taking an untrusted value from the user and putting it in `declare(ticks=%s)` is not something done in practice, as it is likely to expose your system to denial of service even without this bug.

Note You need to log in before you can comment on or make changes to this bug.