Bugzilla – Bug 986391
VUL-0: CVE-2016-5771: php5,php53: Use After Free Vulnerability in PHP's GC algorithm and unserialize
Last modified: 2022-08-03 13:35:28 UTC
http://seclists.org/oss-sec/2016/q2/589 SPL: Fixed bug #72433 (Use After Free Vulnerability in PHP's GC algorithm and unserialize). (Dmitry) https://bugs.php.net/bug.php?id=72433 http://git.php.net/?p=php-src.git;a=commitdiff;h=3f627e580acfdaf0595ae3b115b8bec677f203ee Use CVE-2016-5771. Note that, unlike bug #72434, this does not affect PHP 7.x.
Created attachment 682017 [details] xx.php QA REPRODUCER: php xx.php should print: array(3) { [0]=> *RECURSION* [1]=> *RECURSION* [2]=> object(ArrayObject)#%d (1) { ["storage":"ArrayObject":private]=> *RECURSION* } }
on php 5.6 it prints string(13) "filler_zval_2"
on php53 it currently prints php xx.php PHP Notice: unserialize(): Error at offset 48 of 69 bytes in /suse/meissner/xx.php on line 8 PHP Fatal error: Uncaught exception 'UnexpectedValueException' with message 'Error at offset 6 of 19 bytes' in /suse/meissner/xx.php:8 Stack trace: #0 /suse/meissner/xx.php(8): unserialize('a:3:{i:0;r:1;i:...') #1 {main} thrown in /suse/meissner/xx.php on line 8
bugbot adjusting priority
Already in 12sp2/php7, unaffected. (In reply to Marcus Meissner from comment #2) > on php 5.6 it prints > string(13) "filler_zval_2" The same I get for 12/php5. Fixed in 13.2/php5 and 12/php5.
Will submit now without the fix for 5.3. Please reassign back to me as soon as the release happens, if you still want to fix this for 5.3. (see also bug 986247 comment 5 and bug 986247 comment 6)
Packages submitted.
This is an autogenerated message for OBS integration: This bug (986391) was mentioned in https://build.opensuse.org/request/show/405425 13.2 / php5
This is an autogenerated message for OBS integration: This bug (986391) was mentioned in https://build.opensuse.org/request/show/405458 13.2 / php5
openSUSE-SU-2016:1761-1: An update that fixes 9 vulnerabilities is now available. Category: security (important) Bug References: 986004,986244,986246,986247,986386,986388,986391,986392,986393 CVE References: CVE-2015-8935,CVE-2016-5766,CVE-2016-5767,CVE-2016-5768,CVE-2016-5769,CVE-2016-5770,CVE-2016-5771,CVE-2016-5772,CVE-2016-5773 Sources used: openSUSE 13.2 (src): php5-5.6.1-69.1
SUSE-SU-2016:1842-1: An update that fixes 9 vulnerabilities is now available. Category: security (moderate) Bug References: 986004,986244,986246,986386,986388,986391,986392,986393,988486 CVE References: CVE-2015-8935,CVE-2016-5385,CVE-2016-5766,CVE-2016-5767,CVE-2016-5768,CVE-2016-5769,CVE-2016-5770,CVE-2016-5771,CVE-2016-5772 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP1 (src): php5-5.5.14-68.1 SUSE Linux Enterprise Module for Web Scripting 12 (src): php5-5.5.14-68.1
openSUSE-SU-2016:1922-1: An update that fixes 9 vulnerabilities is now available. Category: security (moderate) Bug References: 986004,986244,986246,986386,986388,986391,986392,986393,988486 CVE References: CVE-2015-8935,CVE-2016-5385,CVE-2016-5766,CVE-2016-5767,CVE-2016-5768,CVE-2016-5769,CVE-2016-5770,CVE-2016-5771,CVE-2016-5772 Sources used: openSUSE Leap 42.1 (src): php5-5.5.14-56.1
unfixed for sle11
An update workflow for this issue was started. This issue was rated as moderate. Please submit fixed packages until 2017-02-13. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/63367
Created attachment 758973 [details] fix for php 5.3
I've provided a patch for php-5.3 for this issue in attachment 758973 [details]. It depends on the patch found in attachment 758972 [details] in bug 986247. The patch backports the get_gc handler function in an ABI compatible way. Since the spl_array contains sub-objects, I had to include a part of the additional garbage collector logic found in php-5.4. It's not completely clear whether php-5.3 is affected by this spl_array issue. The PoC does not work as such and I'm not clear why. The basic vulnerability is the same as in bug 986247, however, which affects php-5.3. Therefore it is better we fix it for php-5.3 as well.
Package submitted. Thanks Matthias.
SUSE-SU-2018:0806-1: An update that fixes 6 vulnerabilities is now available. Category: security (important) Bug References: 1076220,1076391,1080234,1083639,986247,986391 CVE References: CVE-2016-10712,CVE-2016-5771,CVE-2016-5773,CVE-2018-5711,CVE-2018-5712,CVE-2018-7584 Sources used: SUSE Linux Enterprise Software Development Kit 11-SP4 (src): php53-5.3.17-112.20.1 SUSE Linux Enterprise Server 11-SP4 (src): php53-5.3.17-112.20.1 SUSE Linux Enterprise Server 11-SP3-LTSS (src): php53-5.3.17-112.20.1 SUSE Linux Enterprise Point of Sale 11-SP3 (src): php53-5.3.17-112.20.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): php53-5.3.17-112.20.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): php53-5.3.17-112.20.1
done