Bug #72098 [Opn]: Use-after-free in php_var_serialize_class_name()

Edit report at https://bugs.php.net/bug.php?id=72098&edit=1 ID: 72098 User updated by: s dot paraschoudis at gmail dot com Reported by: s dot paraschoudis at gmail dot com Summary: Use-after-free in php_var_serialize_class_name() Status: Open Type: Bug Package: Reproducible crash Operating System: Ubuntu 14.04 64/32bit PHP Version: 5.6.20 Block user comment: N Private report: Y New Comment: Okay. Any plans for fixing it? Thanks. Previous Comments: ------------------------------------------------------------------------ [2016-04-25 01:58:32] stas@php.net Definitely not security issue, the problem is that session_start() in spl_autoload_register() cleans up session, thus destroying the object __sleep is working on. Reproducible also on 5.x. ------------------------------------------------------------------------ [2016-04-24 20:56:12] s dot paraschoudis at gmail dot com Description: ------------ There is a use-after-free vulnerability in php_var_serialize_class_name() which affects all the major php versions. Please note I am not able to reproduce the issue without ASAN instrumentation so this might not be a security issue at all. Test script: --------------- Proof Of Concept ================= <?php spl_autoload_register(function ($class) { session_start(); var_dump("Loading $class"); class Bar {}; }); class Foo { function __sleep() { new Bar; return array(); } } session_start(); $_SESSION['foo'] = new Foo; ?> Actual result: -------------- PHP 7.0.5: symeon@ubuntu:~/Desktop/0days/sessions$ USE_ZEND_ALLOC=0 ASAN_OPTIONS=detect_leaks=0 ~/Desktop/php-7.0.5/sapi/cli/php session_uaf.php string(11) "Loading Bar" ================================================================= ==4308==ERROR: AddressSanitizer: heap-use-after-free on address 0x61200000ebe0 at pc 0x00000169551c bp 0x7ffe612e9690 sp 0x7ffe612e9688 READ of size 8 at 0x61200000ebe0 thread T0 #0 0x169551b in php_var_serialize_class_name /home/symeon/Desktop/php-7.0.5/ext/standard/var.c:658:2 #1 0x1693fa5 in php_var_serialize_class /home/symeon/Desktop/php-7.0.5/ext/standard/var.c:675:21 #2 0x168db05 in php_var_serialize_intern /home/symeon/Desktop/php-7.0.5/ext/standard/var.c:882:9 #3 0x168c308 in php_var_serialize /home/symeon/Desktop/php-7.0.5/ext/standard/var.c:966:2 #4 0x12825e7 in ps_srlzr_encode_php /home/symeon/Desktop/php-7.0.5/ext/session/session.c:1009:2 #5 0x129fa58 in php_session_encode /home/symeon/Desktop/php-7.0.5/ext/session/session.c:223:10 #6 0x12a0464 in php_session_save_current_state /home/symeon/Desktop/php-7.0.5/ext/session/session.c:582:11 #7 0x12a006d in php_session_flush /home/symeon/Desktop/php-7.0.5/ext/session/session.c:1658:3 #8 0x128e0b3 in zm_deactivate_session /home/symeon/Desktop/php-7.0.5/ext/session/session.c:2642:3 #9 0x1ae524a in zend_deactivate_modules /home/symeon/Desktop/php-7.0.5/Zend/zend_API.c:2580:5 #10 0x17b6c18 in php_request_shutdown /home/symeon/Desktop/php-7.0.5/main/main.c:1804:3 #11 0x1f4fb87 in do_cli /home/symeon/Desktop/php-7.0.5/sapi/cli/php_cli.c:1141:3 #12 0x1f48e9a in main /home/symeon/Desktop/php-7.0.5/sapi/cli/php_cli.c:1344:18 #13 0x7f66da36bec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287 #14 0x45f755 in _start (/home/symeon/Desktop/php-7.0.5/sapi/cli/php+0x45f755) 0x61200000ebe0 is located 32 bytes inside of 288-byte region [0x61200000ebc0,0x61200000ece0) freed by thread T0 here: #0 0x4fc800 in __interceptor_free /home/symeon/Desktop/LLVM/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:30 #1 0x198fb76 in _efree /home/symeon/Desktop/php-7.0.5/Zend/zend_alloc.c:2461:4 #2 0x1b2c712 in zend_array_destroy /home/symeon/Desktop/php-7.0.5/Zend/zend_hash.c:1359:2 #3 0x1aa2ff9 in _zval_dtor_func_for_ptr /home/symeon/Desktop/php-7.0.5/Zend/zend_variables.c:96:5 #4 0x1aa2cb0 in i_zval_ptr_dtor /home/symeon/Desktop/php-7.0.5/Zend/zend_variables.h:58:4 #5 0x1aa3143 in _zval_dtor_func_for_ptr /home/symeon/Desktop/php-7.0.5/Zend/zend_variables.c:122:5 #6 0x1a26a70 in i_zval_ptr_dtor /home/symeon/Desktop/php-7.0.5/Zend/zend_variables.h:58:4 #7 0x1a24f0b in _zval_ptr_dtor /home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:533:2 #8 0x1290888 in php_session_track_init /home/symeon/Desktop/php-7.0.5/ext/session/session.c:205:3 #9 0x128a485 in php_session_initialize /home/symeon/Desktop/php-7.0.5/ext/session/session.c:547:2 #10 0x128920e in php_session_start /home/symeon/Desktop/php-7.0.5/ext/session/session.c:1649:2 #11 0x1299727 in zif_session_start /home/symeon/Desktop/php-7.0.5/ext/session/session.c:2313:2 #12 0x1e6236d in ZEND_DO_ICALL_SPEC_HANDLER /home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:586:2 #13 0x1c8324b in execute_ex /home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:417:7 #14 0x1a2ef1e in zend_call_function /home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:863:4 #15 0x1b9091c in zend_call_method /home/symeon/Desktop/php-7.0.5/Zend/zend_interfaces.c:104:12 #16 0x12eca90 in zif_spl_autoload_call /home/symeon/Desktop/php-7.0.5/ext/spl/php_spl.c:429:4 #17 0x1a2f5de in zend_call_function /home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:882:4 #18 0x1a32aa1 in zend_lookup_class_ex /home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:1044:7 #19 0x1a36b8d in zend_fetch_class_by_name /home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:1390:19 #20 0x1d5e3de in ZEND_NEW_SPEC_CONST_HANDLER /home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:3354:9 #21 0x1c8324b in execute_ex /home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:417:7 #22 0x1a2ef1e in zend_call_function /home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:863:4 #23 0x1a2af18 in call_user_function_ex /home/symeon/Desktop/php-7.0.5/Zend/zend_execute_API.c:685:9 #24 0x168d638 in php_var_serialize_intern /home/symeon/Desktop/php-7.0.5/ext/standard/var.c:870:12 #25 0x168c308 in php_var_serialize /home/symeon/Desktop/php-7.0.5/ext/standard/var.c:966:2 #26 0x12825e7 in ps_srlzr_encode_php /home/symeon/Desktop/php-7.0.5/ext/session/session.c:1009:2 #27 0x129fa58 in php_session_encode /home/symeon/Desktop/php-7.0.5/ext/session/session.c:223:10 #28 0x12a0464 in php_session_save_current_state /home/symeon/Desktop/php-7.0.5/ext/session/session.c:582:11 #29 0x12a006d in php_session_flush /home/symeon/Desktop/php-7.0.5/ext/session/session.c:1658:3 previously allocated by thread T0 here: #0 0x4fcb18 in malloc /home/symeon/Desktop/LLVM/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:40 #1 0x198f8b8 in _emalloc /home/symeon/Desktop/php-7.0.5/Zend/zend_alloc.c:2446:11 #2 0x1b141b8 in zend_hash_real_init_ex /home/symeon/Desktop/php-7.0.5/Zend/zend_hash.c:140:3 #3 0x1b1922b in zend_hash_check_init /home/symeon/Desktop/php-7.0.5/Zend/zend_hash.c:163:3 #4 0x1b1f922 in _zend_hash_add_or_update_i /home/symeon/Desktop/php-7.0.5/Zend/zend_hash.c:563:3 #5 0x1b20f54 in _zend_hash_add_new /home/symeon/Desktop/php-7.0.5/Zend/zend_hash.c:653:9 #6 0x1ed72d6 in zend_fetch_dimension_address_inner /home/symeon/Desktop/php-7.0.5/Zend/zend_execute.c:1610:15 #7 0x1e74bc6 in ZEND_ASSIGN_DIM_SPEC_VAR_CONST_HANDLER /home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:17426:19 #8 0x1c8324b in execute_ex /home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:417:7 #9 0x1c83738 in zend_execute /home/symeon/Desktop/php-7.0.5/Zend/zend_vm_execute.h:458:2 #10 0x1ab5fac in zend_execute_scripts /home/symeon/Desktop/php-7.0.5/Zend/zend.c:1427:4 #11 0x17c2891 in php_execute_script /home/symeon/Desktop/php-7.0.5/main/main.c:2487:14 #12 0x1f4d39f in do_cli /home/symeon/Desktop/php-7.0.5/sapi/cli/php_cli.c:974:5 #13 0x1f48e9a in main /home/symeon/Desktop/php-7.0.5/sapi/cli/php_cli.c:1344:18 #14 0x7f66da36bec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287 PHP 6.5.20: ================================================================= ==11546==ERROR: AddressSanitizer: heap-use-after-free on address 0x60300001cd88 at pc 0x0000017154c0 bp 0x7ffe11ecd210 sp 0x7ffe11ecd208 READ of size 8 at 0x60300001cd88 thread T0 #0 0x17154bf in php_var_serialize_class_name /home/symeon/Desktop/php-5.6.20/ext/standard/var.c:607:2 #1 0x1710ccb in php_var_serialize_class /home/symeon/Desktop/php-5.6.20/ext/standard/var.c:623:21 #2 0x1704140 in php_var_serialize_intern /home/symeon/Desktop/php-5.6.20/ext/standard/var.c:813:9 #3 0x16f75b3 in php_var_serialize /home/symeon/Desktop/php-5.6.20/ext/standard/var.c:905:2 #4 0x1300672 in ps_srlzr_encode_php /home/symeon/Desktop/php-5.6.20/ext/session/session.c:982:2 #5 0x1327eeb in php_session_encode /home/symeon/Desktop/php-5.6.20/ext/session/session.c:209:14 #6 0x1328915 in php_session_save_current_state /home/symeon/Desktop/php-5.6.20/ext/session/session.c:542:10 #7 0x13284e1 in php_session_flush /home/symeon/Desktop/php-5.6.20/ext/session/session.c:1634:3 #8 0x1315bde in zm_deactivate_session /home/symeon/Desktop/php-5.6.20/ext/session/session.c:2403:3 #9 0x1bc1ead in zend_deactivate_modules /home/symeon/Desktop/php-5.6.20/Zend/zend_API.c:2449:5 #10 0x185139e in php_request_shutdown /home/symeon/Desktop/php-5.6.20/main/main.c:1867:3 #11 0x1fb1ba5 in do_cli /home/symeon/Desktop/php-5.6.20/sapi/cli/php_cli.c:1177:3 #12 0x1faa2a0 in main /home/symeon/Desktop/php-5.6.20/sapi/cli/php_cli.c:1378:18 #13 0x7f371e059ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287 #14 0x45e195 in _start (/home/symeon/Desktop/php-5.6.20/sapi/cli/php+0x45e195) 0x60300001cd88 is located 8 bytes inside of 32-byte region [0x60300001cd80,0x60300001cda0) freed by thread T0 here: #0 0x4fb240 in __interceptor_free /home/symeon/Desktop/LLVM/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:30 #1 0x1a37276 in _efree /home/symeon/Desktop/php-5.6.20/Zend/zend_alloc.c:2437:3 #2 0x1b0c2e6 in i_zval_ptr_dtor /home/symeon/Desktop/php-5.6.20/Zend/zend_execute.h:80:3 #3 0x1b0ac53 in _zval_ptr_dtor /home/symeon/Desktop/php-5.6.20/Zend/zend_execute_API.c:424:2 #4 0x1b1884e in zend_call_function /home/symeon/Desktop/php-5.6.20/Zend/zend_execute_API.c:889:3 #5 0x1b11a1b in call_user_function_ex /home/symeon/Desktop/php-5.6.20/Zend/zend_execute_API.c:617:9 #6 0x1703b5e in php_var_serialize_intern /home/symeon/Desktop/php-5.6.20/ext/standard/var.c:800:12 #7 0x16f75b3 in php_var_serialize /home/symeon/Desktop/php-5.6.20/ext/standard/var.c:905:2 #8 0x1300672 in ps_srlzr_encode_php /home/symeon/Desktop/php-5.6.20/ext/session/session.c:982:2 #9 0x1327eeb in php_session_encode /home/symeon/Desktop/php-5.6.20/ext/session/session.c:209:14 #10 0x1328915 in php_session_save_current_state /home/symeon/Desktop/php-5.6.20/ext/session/session.c:542:10 #11 0x13284e1 in php_session_flush /home/symeon/Desktop/php-5.6.20/ext/session/session.c:1634:3 #12 0x1315bde in zm_deactivate_session /home/symeon/Desktop/php-5.6.20/ext/session/session.c:2403:3 #13 0x1bc1ead in zend_deactivate_modules /home/symeon/Desktop/php-5.6.20/Zend/zend_API.c:2449:5 #14 0x185139e in php_request_shutdown /home/symeon/Desktop/php-5.6.20/main/main.c:1867:3 #15 0x1fb1ba5 in do_cli /home/symeon/Desktop/php-5.6.20/sapi/cli/php_cli.c:1177:3 #16 0x1faa2a0 in main /home/symeon/Desktop/php-5.6.20/sapi/cli/php_cli.c:1378:18 #17 0x7f371e059ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287 previously allocated by thread T0 here: #0 0x4fb558 in malloc /home/symeon/Desktop/LLVM/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:40 #1 0x1a370c6 in _emalloc /home/symeon/Desktop/php-5.6.20/Zend/zend_alloc.c:2427:10 #2 0x1d771c7 in ZEND_NEW_SPEC_HANDLER /home/symeon/Desktop/php-5.6.20/Zend/zend_vm_execute.h:944:2 #3 0x1d02559 in execute_ex /home/symeon/Desktop/php-5.6.20/Zend/zend_vm_execute.h:363:14 #4 0x1d028af in zend_execute /home/symeon/Desktop/php-5.6.20/Zend/zend_vm_execute.h:388:2 #5 0x1b950b4 in zend_execute_scripts /home/symeon/Desktop/php-5.6.20/Zend/zend.c:1341:4 #6 0x185dd03 in php_execute_script /home/symeon/Desktop/php-5.6.20/main/main.c:2613:14 #7 0x1faeac2 in do_cli /home/symeon/Desktop/php-5.6.20/sapi/cli/php_cli.c:994:5 #8 0x1faa2a0 in main /home/symeon/Desktop/php-5.6.20/sapi/cli/php_cli.c:1378:18 #9 0x7f371e059ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287 PHP 5.5.34: ================================================================= ==57833==ERROR: AddressSanitizer: heap-use-after-free on address 0x60300001ced8 at pc 0x000001705300 bp 0x7ffd3c192810 sp 0x7ffd3c192808 READ of size 8 at 0x60300001ced8 thread T0 #0 0x17052ff in php_var_serialize_class_name /home/symeon/Desktop/php-5.5.34/ext/standard/var.c:607:2 #1 0x17005eb in php_var_serialize_class /home/symeon/Desktop/php-5.5.34/ext/standard/var.c:623:21 #2 0x16f3a50 in php_var_serialize_intern /home/symeon/Desktop/php-5.5.34/ext/standard/var.c:816:9 #3 0x16e6ec3 in php_var_serialize /home/symeon/Desktop/php-5.5.34/ext/standard/var.c:908:2 #4 0x12f4a5a in ps_srlzr_encode_php /home/symeon/Desktop/php-5.5.34/ext/session/session.c:981:2 #5 0x131b9bb in php_session_encode /home/symeon/Desktop/php-5.5.34/ext/session/session.c:209:14 #6 0x131c3e5 in php_session_save_current_state /home/symeon/Desktop/php-5.5.34/ext/session/session.c:542:10 #7 0x131bfb1 in php_session_flush /home/symeon/Desktop/php-5.5.34/ext/session/session.c:1633:3 #8 0x1309b9e in zm_deactivate_session /home/symeon/Desktop/php-5.5.34/ext/session/session.c:2365:3 #9 0x1baa69d in zend_deactivate_modules /home/symeon/Desktop/php-5.5.34/Zend/zend_API.c:2433:5 #10 0x184f78a in php_request_shutdown /home/symeon/Desktop/php-5.5.34/main/main.c:1781:3 #11 0x1f9b51c in do_cli /home/symeon/Desktop/php-5.5.34/sapi/cli/php_cli.c:1177:3 #12 0x1f93c30 in main /home/symeon/Desktop/php-5.5.34/sapi/cli/php_cli.c:1378:18 #13 0x7f6e66d48ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287 #14 0x45d9b5 in _start (/home/symeon/Desktop/php-5.5.34/sapi/cli/php+0x45d9b5) 0x60300001ced8 is located 8 bytes inside of 32-byte region [0x60300001ced0,0x60300001cef0) freed by thread T0 here: #0 0x4faa60 in __interceptor_free /home/symeon/Desktop/LLVM/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:30 #1 0x1a276d6 in _efree /home/symeon/Desktop/php-5.5.34/Zend/zend_alloc.c:2437:3 #2 0x1afd5d6 in i_zval_ptr_dtor /home/symeon/Desktop/php-5.5.34/Zend/zend_execute.h:82:3 #3 0x1afbf43 in _zval_ptr_dtor /home/symeon/Desktop/php-5.5.34/Zend/zend_execute_API.c:423:2 #4 0x1b0c610 in zend_call_function /home/symeon/Desktop/php-5.5.34/Zend/zend_execute_API.c:994:3 #5 0x1b05acb in call_user_function_ex /home/symeon/Desktop/php-5.5.34/Zend/zend_execute_API.c:722:9 #6 0x16f346e in php_var_serialize_intern /home/symeon/Desktop/php-5.5.34/ext/standard/var.c:803:12 #7 0x16e6ec3 in php_var_serialize /home/symeon/Desktop/php-5.5.34/ext/standard/var.c:908:2 #8 0x12f4a5a in ps_srlzr_encode_php /home/symeon/Desktop/php-5.5.34/ext/session/session.c:981:2 #9 0x131b9bb in php_session_encode /home/symeon/Desktop/php-5.5.34/ext/session/session.c:209:14 #10 0x131c3e5 in php_session_save_current_state /home/symeon/Desktop/php-5.5.34/ext/session/session.c:542:10 #11 0x131bfb1 in php_session_flush /home/symeon/Desktop/php-5.5.34/ext/session/session.c:1633:3 #12 0x1309b9e in zm_deactivate_session /home/symeon/Desktop/php-5.5.34/ext/session/session.c:2365:3 #13 0x1baa69d in zend_deactivate_modules /home/symeon/Desktop/php-5.5.34/Zend/zend_API.c:2433:5 #14 0x184f78a in php_request_shutdown /home/symeon/Desktop/php-5.5.34/main/main.c:1781:3 #15 0x1f9b51c in do_cli /home/symeon/Desktop/php-5.5.34/sapi/cli/php_cli.c:1177:3 #16 0x1f93c30 in main /home/symeon/Desktop/php-5.5.34/sapi/cli/php_cli.c:1378:18 #17 0x7f6e66d48ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287 previously allocated by thread T0 here: #0 0x4fad78 in malloc /home/symeon/Desktop/LLVM/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:40 #1 0x1a27526 in _emalloc /home/symeon/Desktop/php-5.5.34/Zend/zend_alloc.c:2427:10 #2 0x1d4d037 in ZEND_NEW_SPEC_HANDLER /home/symeon/Desktop/php-5.5.34/Zend/zend_vm_execute.h:757:2 #3 0x1cd19c9 in execute_ex /home/symeon/Desktop/php-5.5.34/Zend/zend_vm_execute.h:363:14 #4 0x1cd1d1f in zend_execute /home/symeon/Desktop/php-5.5.34/Zend/zend_vm_execute.h:388:2 #5 0x1b7ee94 in zend_execute_scripts /home/symeon/Desktop/php-5.5.34/Zend/zend.c:1327:4 #6 0x185c0e3 in php_execute_script /home/symeon/Desktop/php-5.5.34/main/main.c:2525:14 #7 0x1f98430 in do_cli /home/symeon/Desktop/php-5.5.34/sapi/cli/php_cli.c:994:5 #8 0x1f93c30 in main /home/symeon/Desktop/php-5.5.34/sapi/cli/php_cli.c:1378:18 #9 0x7f6e66d48ec4 in __libc_start_main /build/eglibc-3GlaMS/eglibc-2.19/csu/libc-start.c:287 Cheers, Symeon ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72098&edit=1