Bug 1120266 (CVE-2014-4670) - CVE-2014-4670 php: SPL Iterators use-after-free
Summary: CVE-2014-4670 php: SPL Iterators use-after-free
Status: CLOSED ERRATA
Alias: CVE-2014-4670
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,public=20140629,reported=2...
Keywords: Security
Depends On: 1114521 1140017 1140018 1140023 1140026 1140027 1149762 1149771
Blocks: 1120269 1138881 1149858
TreeView+ depends on / blocked
 
Reported: 2014-07-16 15:05 UTC by Vincent Danen
Modified: 2018-12-09 18:10 UTC (History)
17 users (show)

Fixed In Version: php 5.5.15
Doc Type: Bug Fix
Doc Text:
A use-after-free flaw was found in the way PHP handled certain Standard PHP Library (SPL) Iterators. A malicious script author could possibly use this flaw to disclose certain portions of server memory.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-10-31 10:03:23 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:1326 normal SHIPPED_LIVE Moderate: php53 and php security update 2014-09-30 09:14:20 UTC
Red Hat Product Errata RHSA-2014:1327 normal SHIPPED_LIVE Moderate: php security update 2014-09-30 13:09:42 UTC
Red Hat Product Errata RHSA-2014:1765 normal SHIPPED_LIVE Important: php54-php security update 2014-10-30 23:45:24 UTC
Red Hat Product Errata RHSA-2014:1766 normal SHIPPED_LIVE Important: php55-php security update 2014-10-30 23:45:12 UTC

Description Vincent Danen 2014-07-16 15:05:30 UTC
It was reported [1] that PHP incorrectly handled certain SPL Iterators.  A local attacker, in particular shared hosting environments relying on PHP features such as open_basedir, safe_mode, disable_functions, and similar), could use this flaw to cause PHP to crash, resulting in a denial of service.

This has been fixed upstream [2].

[1] https://bugs.php.net/bug.php?id=67538
[2] http://git.php.net/?p=php-src.git;a=commit;h=df78c48354f376cf419d7a97f88ca07d572f00fb

Comment 1 Vincent Danen 2014-07-16 15:10:07 UTC
Similar to bug #1120259 I'm not convinced this is something that should have ever gotten a CVE.  There is a reproducer noted in the original bug report and it doesn't crash with php53 on RHEL5, php on RHEL6, or php on RHEL7.

The upstream bug report indicates:

"""
Please use CVE-2014-4670, the bug is in fact exploitable - not sure why was it made public before release of a patched version.

It's not remotely exploitable, however, shared environments relying on PHP security features (open_basedir, safe_mode in older PHPs, disable_functions and similar) are affected. We're ready to provide PoC is needed.
"""

So you run a custom PHP script to cause PHP to crash, locally, from the command-line.  You can do that a hundred and one other ways too.

It's possible that, like the other bug, I'm missing something but I'm not sure why this is being given a CVE (although, in fairness, some of our protections may be interfering here and a "vanilla" PHP on some other OS may have undesirable affects).

Comment 2 Lukas Kuzmiak 2014-07-20 20:50:44 UTC
Hello Vincent,

our research team originally reported this bug - so let me put some more light onto the problem.

The bug nature is use-after-free - there are a couple of wrong reads and writes if you run it in valgrind - it does not generate segfault every time.

It's not just a DoS bug as noted here: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-4670 .. as that's completely useless as you said - you'd just crash an ie. apache child running that PHP process and cause exactly nothing.

It's however also a "or possibly have unspecified other impact" thing.

The use-after-free also allows (after some heap-spraying and putting objects correctly onto the heap) to read and write arbitrary memory of the PHP process.

That is why we said that "shared environments relying on PHP security features (open_basedir, safe_mode in older PHPs, disable_functions and similar) are affected."

Simply because using this (also the other one + tons of other similar bugs in PHP) you can disable open_basedir, safe_mode, re-enable disable_functions and do basically anything PHP has implemented as protection measure .. and after you've done so (as noted - if the shared hosting rely only on PHP protections) ie. browse through hundreds of applications hosted on the same host.

Same applies for the other bug (CVE-2014-4698). I hope this explains why this should have gotten a CVE.

I'm not even gonna start on why PHP team made these issues public as the first thing after we reported them with "Security" tag.

Lukas

Comment 3 Vincent Danen 2014-07-21 17:42:51 UTC
Hi, Lukas.  Thanks for this additional information.

If the only real issue here is with environments using safe_mode, etc. for a "secure PHP environment" then we have stated repeatedly in the past that the bypass of those protections is not something we consider security-relevant as per bug #169857.

Someone will be reviewing this further, however, to see if there is some relevance outside of those types of quasi-protections (i.e. a real use-case that doesn't factor safe_mode/etc into consideration as we don't believe, and neither does upstream, that those are real security mechanisms).

Comment 5 Remi Collet 2014-09-10 05:44:25 UTC
rhel5/php is not affected (PHP 5.1 doesn't have the SplDoublyLinkedList class)

Comment 10 Martin Prpič 2014-09-25 12:15:30 UTC
IssueDescription:

A use-after-free flaw was found in the way PHP handled certain Standard PHP Library (SPL) Iterators. A malicious script author could possibly use this flaw to disclose certain portions of server memory.

Comment 11 errata-xmlrpc 2014-09-30 05:14:51 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5

Via RHSA-2014:1326 https://rhn.redhat.com/errata/RHSA-2014-1326.html

Comment 12 errata-xmlrpc 2014-09-30 09:10:07 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:1327 https://rhn.redhat.com/errata/RHSA-2014-1327.html

Comment 15 errata-xmlrpc 2014-10-30 19:46:32 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6

Via RHSA-2014:1766 https://rhn.redhat.com/errata/RHSA-2014-1766.html

Comment 16 errata-xmlrpc 2014-10-30 19:48:13 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6

Via RHSA-2014:1765 https://rhn.redhat.com/errata/RHSA-2014-1765.html

Comment 17 Tomas Hoger 2014-10-31 10:03:23 UTC
Statement:

This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 5.


Note You need to log in before you can comment on or make changes to this bug.