phpinfo() Type Confusion Information Leak Vulnerability

[Kurt Cancemi]

Reported in php as bug #67498 by Stefan Esser.

Here is an excerpt from the bug of some of the capabilities of this security bug:

Because this is only exploitable in case these variables are overwritten
as integers, which is less likely in a remote context this has to be
mostly considered a local information leak only. However if you are
running as mod_php and there is mod_ssl this could be used to steal the
private SSL key from memory (if you can inject PHP code).

I attached the upstream fix.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "bug67948.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Seth Arnold (seth-arnold)]

Thanks for reporting this issue; however, I do not believe this is a security fix, rather a simple reliability fix.

he PHP team has been clear that the interpreter is not designed nor intended to provide any kind of security layer and scripts executing in the interpreter should be considered to have full, legitimate, access to everything that is available to the PHP interpreter.

In this case that means that TLS private keys available to mod_ssl are intentionally available to all PHP scripts running via mod_php. Any administrator that wants to keep TLS private keys away from PHP must use a mechanism such as CGI, FastCGI, or PHP FPM to execute the scripts in a different address space and with different privileges.

Thanks

[Ondřej Surý (ondrej)]

Seth, I don't think that mod_php has functions to access random memory chunks under normal conditions...

Thus I don't think that TLS private keys are available to PHP scripts if the permissions are correctly set in the apache2.

I believe this is worth fixing anyway.

[Robie Basak (racb)]

Link to upstream bug: https://bugs.php.net/bug.php?id=67498

Which specific versions of PHP in Ubuntu are affected, please? And can we have the specific upstream VCS commits that we would be cherry-picking to Ubuntu?

> I believe this is worth fixing anyway.

What is the exact impact to ordinary users here? What will go wrong for our users if it is not patched?

[Kurt Cancemi (x64architecture)]

This can be closed because this CVE and a whole other bunch of CVE's were fixed in bug #1338170 which was filed after this bug report.