search

remicollet / php-src-security

Security backports for EOL versions of PHP.
Other
39 stars 9 forks source link

CVE-2024-8929 mysqlnd: Leak partial content of the heap through heap buffer over-read #26

Open remicollet opened 1 week ago

remicollet commented 1 week ago

Fix not backported from 8.1.31

The fix did not apply safely, need some adaptations, and raise segfault in test suite, so more work needed.

Notice: this security flaw requires a specially crafted answer from the server, so is very unlikely to be exploitable in a sane env (using a trusted server)/

remicollet commented 1 week ago

Help welcome if someone have time to work on this, perhaps @bukka may help (despite he is usually very busy)

bukka commented 1 week ago

I don't understand. The fix was developed against 8.1 and pipeline was green: https://github.com/php/php-src/actions/runs/11916010048/job/33207651714 . What segfault are your referring to?

bukka commented 1 week ago

Also PHP-8.1 branch is green: https://github.com/php/php-src/tree/PHP-8.1

bukka commented 1 week ago

Oh, you are talking about older branches.

bukka commented 1 week ago

I'm not sure if I can use my foundation time on this and unfortunately way too busy in my free time.

bukka commented 1 week ago

I will discuss this kind of support for PHP older branches during our meeting on Monday and let you know then.

remicollet commented 2 days ago

Applied (and adapted) in 8.0 branch

=====================================================================
Number of tests :  433               397
Tests skipped   :   36 (  8.3%) --------
Tests warned    :    0 (  0.0%) (  0.0%)
Tests failed    :    0 (  0.0%) (  0.0%)
Expected fail   :    3 (  0.7%) (  0.8%)
Tests passed    :  394 ( 91.0%) ( 99.2%)
---------------------------------------------------------------------
Time taken      :  139 seconds
=====================================================================

For memory, 69853e12b73a989e2383452356cdc07172427ae3 was needed to avoid segfault (from 8.1)

remicollet commented 2 days ago

Also applied and adapted for 7.4

=====================================================================
Number of tests :  436               393
Tests skipped   :   43 (  9.9%) --------
Tests warned    :    0 (  0.0%) (  0.0%)
Tests failed    :    0 (  0.0%) (  0.0%)
Expected fail   :    3 (  0.7%) (  0.8%)
Tests passed    :  390 ( 89.4%) ( 99.2%)
---------------------------------------------------------------------
Time taken      :  114 seconds
=====================================================================
remicollet commented 1 day ago

Also applied and adapted for 7.3

=====================================================================
Number of tests :  428               389
Tests skipped   :   39 (  9.1%) --------
Tests warned    :    0 (  0.0%) (  0.0%)
Tests failed    :    0 (  0.0%) (  0.0%)
Expected fail   :    3 (  0.7%) (  0.8%)
Tests passed    :  386 ( 90.2%) ( 99.2%)
---------------------------------------------------------------------
Time taken      :  100 seconds
=====================================================================

Not planed for older versions for now