Sec Bug->Bug #67338 [Opn]: Data from Faulting Address controls subsequent Write Address

Edit report at https://bugs.php.net/bug.php?id=67338&edit=1 ID: 67338 Updated by: stas@php.net Reported by: jigsaw0658 at gmail dot com Summary: Data from Faulting Address controls subsequent Write Address Status: Open -Type: Security +Type: Bug Package: Apache2 related Operating System: Windows 7_64bit PHP Version: Irrelevant Block user comment: N Private report: Y New Comment: Doesn't look like a security issue. Previous Comments: ------------------------------------------------------------------------ [2014-05-25 14:22:53] jigsaw0658 at gmail dot com Hi, let me explain how i detected this behavior : the first time i tested the script it triggers the crash of Apache service httpd.exe until i restart the service again. This behavior occurred 3 times while executing the same script but later i wasn't able to reproduce it, anyway here is the script i used : <?php session_start(); set_time_limit(5000); $code = md5(uniqid(rand(), true)); $HTTP['http']['method'] = 'GET'; $HTTP['http']['follow_location'] = 0; $HTTP['http']['header'] = "Host: host.com\r\n"; $HTTP['http']['header'] .= "Referer: http://host.com/\r\n"; $HTTP['http']['header'] = "Cookie: COOKIE=u275gfdjphn0rr721avhgcps82; screenWidth=1366\r\n"; $link = "http://example.com/index.php?Page=Login&Action=ConfirmCode&user=1&code=$code"; $context = stream_context_create($HTTP); $string = file_get_contents($link, false, $context); $file = "log1.txt"; file_put_contents($file,$string); function RightLine($str,$r) { $str = 'Fill in the form to generate a new password. An email will be sent to you containing a link which you must click to confirm your password change.'; $matches = array(); $file = "log1.txt"; $handle = fopen($file, "r"); if ($handle) { while (!feof($handle)) { $buffer = fgets($handle); if(strpos($buffer, $str) == TRUE) $matches[] = $buffer; } fclose($handle); } $res = substr($matches[0],$r = 0); return $res; } do { RightLine($str,$r); }while(RightLine($str,$r) == $str); echo $code; ?> ------------------------------------------------------------------------ [2014-05-25 08:52:27] pajoye@php.net Thanks for the report. Could you attach the test.php script please? ------------------------------------------------------------------------ [2014-05-25 00:19:56] jigsaw0658 at gmail dot com Description: ------------ The bug reside in the following piece of code : https://github.com/php/php-src/blob/master/Zend/zend_opcode.c ZEND_API void destroy_op_array(zend_op_array *op_array TSRMLS_DC) { zend_literal *literal = op_array->literals; zend_literal *end; zend_uint i; if (op_array->static_variables) { zend_hash_destroy(op_array->static_variables); FREE_HASHTABLE(op_array->static_variables); } if (op_array->run_time_cache) { efree(op_array->run_time_cache); } //op_array->refcount = (zend_uint *) emalloc(sizeof(zend_uint)); //*op_array->refcount = 1; initialized here. if (--(*op_array->refcount)>0) { // Exception occur here (Invalid Pointer). return; } efree(op_array->refcount); . . . . } =============================================================================== Crash Dump and analysis results : ( you can check that to confirm this analysis) I used Microsoft crash analyzer to see if it's exploitable or no. the results information : !exploitable 1.6.0.0 HostMachine\HostUser Executing Processor Architecture is x86 Debuggee is in User Mode Debuggee is a user mode small dump file Event Type: Exception Exception Faulting Address: 0x5883050 Second Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005) Exception Sub-Type: Read Access Violation Faulting Instruction:0217d315 mov edx,dword ptr [eax] Basic Block: 0217d315 mov edx,dword ptr [eax] Tainted Input operands: 'eax' 0217d317 dec edx Tainted Input operands: 'edx' 0217d318 mov dword ptr [eax],edx Tainted Input operands: 'eax','edx' 0217d31a mov eax,dword ptr [esi+24h] 0217d31d cmp dword ptr [eax],0 0217d320 ja php5ts!destroy_op_array+0x194 (0217d474) Exception Hash (Major/Minor): 0xff233afd.0x01458bdd Hash Usage : Stack Trace: Major+Minor : php5ts!destroy_op_array+0x35 Major+Minor : php5ts!destroy_zend_function+0x18 Major+Minor : php5ts!zend_function_dtor+0x14 Major+Minor : php5ts!zend_hash_destroy+0x27 Instruction Address: 0x000000000217d315 Description: Data from Faulting Address controls subsequent Write Address Short Description: TaintedDataControlsWriteAddress Exploitability Classification: PROBABLY_EXPLOITABLE Recommended Bug Title: Probably Exploitable - Data from Faulting Address controls subsequent Write Address starting at php5ts!destroy_op_array+0x0000000000000035 (Hash=0xff233afd.0x01458bdd) The data from the faulting address is later used as the target for a later write. 0:000> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* ***** OS symbols are WRONG. Please fix symbols to do analysis. ***** OS symbols are WRONG. Please fix symbols to do analysis. ***** OS (WOW64 kernel32) symbols are WRONG. Please fix symbols to do analysis. ***** OS (WOW64 kernel32) symbols are WRONG. Please fix symbols to do analysis. ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: ntdll!_PEB *** *** *** ************************************************************************* ********************************************************************* * Symbols can not be loaded because symbol path is not initialized. * * * * The Symbol Path can be set by: * * using the _NT_SYMBOL_PATH environment variable. * * using the -y <symbol_path> argument when starting the debugger. * * using .sympath and .sympath+ * ********************************************************************* ********************************************************************* * Symbols can not be loaded because symbol path is not initialized. * * * * The Symbol Path can be set by: * * using the _NT_SYMBOL_PATH environment variable. * * using the -y <symbol_path> argument when starting the debugger. * * using .sympath and .sympath+ * ********************************************************************* *** ERROR: Symbol file could not be found. Defaulted to export symbols for user32.dll - ********************************************************************* * Symbols can not be loaded because symbol path is not initialized. * * * * The Symbol Path can be set by: * * using the _NT_SYMBOL_PATH environment variable. * * using the -y <symbol_path> argument when starting the debugger. * * using .sympath and .sympath+ * ********************************************************************* FAULTING_IP: php5ts!destroy_op_array+35 0217d315 8b10 mov edx,dword ptr [eax] EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff) ExceptionAddress: 0217d315 (php5ts!destroy_op_array+0x00000035) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000000 Parameter[1]: 05883050 Attempt to read from address 05883050 DEFAULT_BUCKET_ID: WRONG_SYMBOLS PROCESS_NAME: httpd.exe FAULTING_MODULE: 77130000 kernel32 DEBUG_FLR_IMAGE_TIMESTAMP: 481b8f4b MODULE_NAME: php5ts ERROR_CODE: (NTSTATUS) 0xc0000005 - L READ_ADDRESS: 05883050 BUGCHECK_STR: ACCESS_VIOLATION LAST_CONTROL_TRANSFER: from 0217d068 to 0217d315 STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. 000cfdac 0217d068 05889088 0024d010 0217d084 php5ts!destroy_op_array+0x35 000cfdb8 0217d084 05990b80 0024d010 00000000 php5ts!destroy_zend_function+0x18 000cfdcc 0216c537 05990b80 76de9894 029a5d68 php5ts!zend_function_dtor+0x14 00000000 00000000 00000000 00000000 00000000 php5ts!zend_hash_destroy+0x27 STACK_COMMAND: ~0s; .ecxr ; kb FAULTING_THREAD: 00018910 FOLLOWUP_IP: php5ts!destroy_op_array+35 0217d315 8b10 mov edx,dword ptr [eax] SYMBOL_STACK_INDEX: 0 FOLLOWUP_NAME: MachineOwner IMAGE_NAME: php5ts.dll SYMBOL_NAME: php5ts!destroy_op_array+35 BUCKET_ID: WRONG_SYMBOLS Followup: MachineOwner --------- Test script: --------------- Actually i tested with a script but it didn't work, i didn't find a way to reproduce the bug since the first time occurred but i'll provide a crash dump when the bug is reviewed that can help you to analyze more this behavior. Expected result: ---------------- -Denial of service in Apache Web server. -Apache crashed once the script "test.php" is executed. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=67338&edit=1