Bug 1443487 (CVE-2017-6441) - CVE-2017-6441 php: Null pointer dereference via crafted "declare(ticks="
Summary: CVE-2017-6441 php: Null pointer dereference via crafted "declare(ticks="
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2017-6441
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1443534
Blocks: 1443491
TreeView+ depends on / blocked
 
Reported: 2017-04-19 10:56 UTC by Adam Mariš
Modified: 2019-09-29 14:10 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-04-27 05:25:39 UTC
Embargoed:

Attachments (Terms of Use)

Description Adam Mariš 2017-04-19 10:56:52 UTC 
The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of "declare(ticks=" in a PHP script.

Upstream issue:

https://github.com/php/php-src/pull/2396
Comment 1 Adam Mariš 2017-04-19 12:41:17 UTC 
Created php tracking bugs for this issue:

Affects: fedora-all [bug 1443534]
Comment 2 Doran Moppert 2017-04-27 05:25:39 UTC 
Upstream bug:

https://bugs.php.net/bug.php?id=74146

I agree with the vendor's assessment:  this is not a security issue.  It is a crash triggered by executing (essentially) arbitrary PHP code.  Taking an untrusted value from the user and putting it in `declare(ticks=%s)` is not something done in practice, as it is likely to expose your system to denial of service even without this bug.
Note You need to log in before you can comment on or make changes to this bug.