CVE-2017-11628

Vulnerability

A stack-based buffer overflow exists in the zend_ini_do_op() function in Zend/zend_ini_parser.c in PHP versions before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7 [1][2]. The vulnerability occurs when specially crafted input is passed via parse_ini_string() or parse_ini_file(). This is only reachable in applications that accept untrusted INI content (e.g., web-based syntax validators), not from the standard php.ini file [2]. The function copies a string into a fixed-size stack buffer (str_result) without proper length validation, potentially writing one byte past the buffer boundary [2].

Exploitation

An attacker who can provide malicious input to a PHP application using either parse_ini_string() or parse_ini_file() can trigger the overflow by supplying an INI directive value with a specific numeric interpretation that forces zend_ini_do_op() to perform a copy beyond the allocated buffer size [2]. The overflow writes a single NULL byte or an integer representation past the bounds of the stack buffer. On systems without stack smashing protection, this may corrupt adjacent variables or the return address [2]. No authentication or special network position is required beyond the ability to submit arbitrary INI data.

Impact

Successful exploitation can lead to a denial of service (e.g., crash due to stack smashing detection) or, depending on compiler optimizations and stack layout, arbitrary code execution with the privileges of the PHP process [1][2]. The impact is limited to applications that expose INI parsing to untrusted data, but a full remote code execution scenario is considered possible [2].

Mitigation

The vulnerability is fixed in PHP 5.6.31, 7.0.21, and 7.1.7 [2]. Red Hat Software Collections shipped a patched version (rh-php70-php 7.0.27) as part of RHSA-2018:1296 [1]. Gentoo Linux also provides updated packages >=dev-lang/php-5.6.31 and >=dev-lang/php-7.0.23 [3]. Upgrading to the fixed version is the recommended mitigation. No workaround is available for unpatched installations; disabling the vulnerable functions is a potential but operationally restrictive measure [3].