Bug 1120259 (CVE-2014-4698) - CVE-2014-4698 php: ArrayIterator use-after-free due to object change during sorting
Summary: CVE-2014-4698 php: ArrayIterator use-after-free due to object change during s...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-4698
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,public=20140629,reported=2...
Depends On: 1114521 1140017 1140018 1140023 1140026 1140027 1149762 1149771
Blocks: 1120269 1138881 1149858
TreeView+ depends on / blocked
 
Reported: 2014-07-16 14:48 UTC by Vincent Danen
Modified: 2019-06-08 20:06 UTC (History)
16 users (show)

Fixed In Version: php 5.5.15
Doc Type: Bug Fix
Doc Text:
A use-after-free flaw was found in the way PHP handled certain ArrayIterators. A malicious script author could possibly use this flaw to disclose certain portions of server memory.
Clone Of:
Environment:
Last Closed: 2014-10-31 10:00:19 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:1326 normal SHIPPED_LIVE Moderate: php53 and php security update 2014-09-30 09:14:20 UTC
Red Hat Product Errata RHSA-2014:1327 normal SHIPPED_LIVE Moderate: php security update 2014-09-30 13:09:42 UTC
Red Hat Product Errata RHSA-2014:1765 normal SHIPPED_LIVE Important: php54-php security update 2014-10-30 23:45:24 UTC
Red Hat Product Errata RHSA-2014:1766 normal SHIPPED_LIVE Important: php55-php security update 2014-10-30 23:45:12 UTC

Description Vincent Danen 2014-07-16 14:48:03 UTC
It was reported [1] that PHP incorrectly handled certain ArrayIterators.  A local attacker, in particular shared hosting environments relying on PHP features such as open_basedir, safe_mode, disable_functions, and similar), could use this flaw to cause PHP to crash, resulting in a denial of service.

[1] https://bugs.php.net/bug.php?id=67539

Comment 1 Vincent Danen 2014-07-16 14:55:44 UTC
I'm not convinced this is something that should have ever gotten a CVE.  There is a reproducer noted in the original bug report, and in order to see anything interesting, you need to run it under valgrind, but even then with a certain environment variable set (that twiddles with memory handling?  It's USE_ZEND_ALLOC=0).  When run without valgrind, I don't see the script dying, and I tried with php53 on RHEL5 and php on RHEL6.  With php on RHEL7 is does complain that it ran out of memory (Allowed memory exhausted).

But the upstream bug report indicates:

"""
Please use CVE-2014-4698, the bug is in fact exploitable - not sure why was it made public before release of a patched version.

It's not remotely exploitable, however, shared environments relying on PHP security features (open_basedir, safe_mode in older PHPs, disable_functions and similar) are affected. We're ready to provide PoC is needed.
"""

So you run a custom PHP script to cause PHP to crash, locally, from the command-line.  You can do that a hundred and one other ways too.

Perhaps I'm missing something?

Comment 2 Vincent Danen 2014-07-16 14:57:39 UTC
Oh, forgot to note the fix:

http://git.php.net/?p=php-src.git;a=commit;h=22882a9d89712ff2b6ebc20a689a89452bba4dcd

Comment 4 Remi Collet 2014-09-10 05:48:33 UTC
rhel5/php is not affected (PHP 5.1 doesn't have the unserialize method for the ArrayIterator class)

Comment 9 Martin Prpič 2014-09-25 12:16:17 UTC
IssueDescription:

A use-after-free flaw was found in the way PHP handled certain ArrayIterators. A malicious script author could possibly use this flaw to disclose certain portions of server memory.

Comment 10 errata-xmlrpc 2014-09-30 05:14:48 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5

Via RHSA-2014:1326 https://rhn.redhat.com/errata/RHSA-2014-1326.html

Comment 11 errata-xmlrpc 2014-09-30 09:10:05 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:1327 https://rhn.redhat.com/errata/RHSA-2014-1327.html

Comment 14 errata-xmlrpc 2014-10-30 19:46:29 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6

Via RHSA-2014:1766 https://rhn.redhat.com/errata/RHSA-2014-1766.html

Comment 15 errata-xmlrpc 2014-10-30 19:55:00 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6

Via RHSA-2014:1765 https://rhn.redhat.com/errata/RHSA-2014-1765.html

Comment 16 Tomas Hoger 2014-10-31 10:00:19 UTC
Statement:

This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 5.


Note You need to log in before you can comment on or make changes to this bug.