How to test if I'm vulnerable regarding CVE-2014-3515? My vendor supplied me with a patch and verified that it installed however I would like to verify that I am no longer vulnerable. My vendor currently does not provide any instructions on how to do this. I am working with a Linux platform.
Stefan Esser actually wrote a proof of concept for this vulnerability. You can find the entire post here. I will not reproduce the code here because it's super long, but the general gist of it is this:
- Spray the heap with a repeated pattern of fake hashtables, buckets and zvals
- Trigger the malicious unserialize().
- Program segfaults
- Picking through the coredump reveals that you control the Return Instruction Pointer, and therefore have pwned the machine very, very hard.
This POC was developed for a Mac OSX system running PHP 5.4.24, so it may or may not work against a Linux system.
This isn't the sort of thing that can be verified like an OS vulnerability. If you have patched to the appropriate level, then you're covered.