Bug #72155 [Opn->Csd]: use-after-free caused by get_zval_xmlrpc_type

Edit report at https://bugs.php.net/bug.php?id=72155&edit=1 ID: 72155 Updated by: krakjoe@php.net Reported by: shm@php.net Summary: use-after-free caused by get_zval_xmlrpc_type -Status: Open +Status: Closed Type: Bug Package: XMLRPC-EPI related PHP Version: 7.0.6 Block user comment: N Private report: N New Comment: Automatic comment on behalf of krakjoe Revision: http://git.php.net/?p=php-src.git;a=commit;h=1690dcb827e2b50eb575b1c6acadab0b8f248723 Log: fix #72155 (use-after-free caused by get_zval_xmlrpc_type) Previous Comments: ------------------------------------------------------------------------ [2016-05-22 04:22:22] php-bugs at lists dot php dot net No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Re-Opened". Thank you. ------------------------------------------------------------------------ [2016-05-10 05:32:20] stas@php.net I'm not sure I understand - how this could allow remote code execution? ------------------------------------------------------------------------ [2016-05-04 14:18:48] shm@php.net The following patch has been added/updated: Patch Name: p.diff Revision: 1462371528 URL: https://bugs.php.net/patch-display.php?bug=72155&patch=p.diff&revision=1462371528 ------------------------------------------------------------------------ [2016-05-04 14:18:25] shm@php.net Description: ------------ zval_copy_ctor() seems to be missing in get_zval_xmlrpc_type which can be reachable via xmlrpc_encode(), this cause use-after-free condition. This bug may allow for code execution. Please verify my patch before committing. Test script: --------------- <?php $var0 = fopen("/etc/passwd","r"); $var1 = xmlrpc_encode($var0); Expected result: ---------------- Use-after-free should be avoided. Actual result: -------------- gdb-peda$ r xmlrpc_encode.uaf.php [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". [New process 10058] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". process 10058 is executing new program: /usr/lib/llvm-3.4/bin/llvm-symbolizer ================================================================= ==10054== ERROR: AddressSanitizer: heap-use-after-free on address 0x600600023140 at pc 0xf27b27 bp 0x7fffffffbfe0 sp 0x7fffffffbfd8 READ of size 4 at 0x600600023140 thread T0 [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". #0 0xf27b26 in zval_delref_p /home/shm/src/php-7.0.6/Zend/zend_types.h:827 #1 0xf2833b in i_zval_ptr_dtor /home/shm/src/php-7.0.6/Zend/zend_variables.h:57 #2 0xf29593 in _zval_ptr_dtor_wrapper /home/shm/src/php-7.0.6/Zend/zend_variables.c:260 #3 0xf65ccf in _zend_hash_del_el_ex /home/shm/src/php-7.0.6/Zend/zend_hash.c:1026 #4 0xf65f94 in _zend_hash_del_el /home/shm/src/php-7.0.6/Zend/zend_hash.c:1050 #5 0xf69369 in zend_hash_graceful_reverse_destroy /home/shm/src/php-7.0.6/Zend/zend_hash.c:1502 #6 0xeefbba in shutdown_executor /home/shm/src/php-7.0.6/Zend/zend_execute_API.c:277 #7 0xf2ebd5 in zend_deactivate /home/shm/src/php-7.0.6/Zend/zend.c:967 #8 0xdbe174 in php_request_shutdown /home/shm/src/php-7.0.6/main/main.c:1833 #9 0x1148f32 in do_cli /home/shm/src/php-7.0.6/sapi/cli/php_cli.c:1141 #10 0x114a5d6 in main /home/shm/src/php-7.0.6/sapi/cli/php_cli.c:1344 #11 0x7ffff401bec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) #12 0x4247a8 in _start (/home/shm/src/php-7.0.6/sapi/cli/php+0x4247a8) 0x600600023140 is located 0 bytes inside of 24-byte region [0x600600023140,0x600600023158) freed by thread T0 here: #0 0x7ffff4e6033a (/usr/lib/x86_64-linux-gnu/libasan.so.0+0x1533a) #1 0xea65d9 in _efree /home/shm/src/php-7.0.6/Zend/zend_alloc.c:2461 #2 0xf7161d in list_entry_destructor /home/shm/src/php-7.0.6/Zend/zend_list.c:189 #3 0xf65ccf in _zend_hash_del_el_ex /home/shm/src/php-7.0.6/Zend/zend_hash.c:1026 #4 0xf6749c in zend_hash_index_del /home/shm/src/php-7.0.6/Zend/zend_hash.c:1228 #5 0xf70be8 in zend_list_free /home/shm/src/php-7.0.6/Zend/zend_list.c:59 #6 0xf28984 in _zval_dtor_func_for_ptr /home/shm/src/php-7.0.6/Zend/zend_variables.c:116 #7 0x1008a96 in zend_vm_stack_free_args /home/shm/src/php-7.0.6/Zend/zend_execute.h:250 #8 0x101cf7c in ZEND_DO_ICALL_SPEC_HANDLER /home/shm/src/php-7.0.6/Zend/zend_vm_execute.h:596 #9 0x101be38 in execute_ex /home/shm/src/php-7.0.6/Zend/zend_vm_execute.h:414 #10 0x101c093 in zend_execute /home/shm/src/php-7.0.6/Zend/zend_vm_execute.h:458 #11 0xf31421 in zend_execute_scripts /home/shm/src/php-7.0.6/Zend/zend.c:1427 #12 0xdc0beb in php_execute_script /home/shm/src/php-7.0.6/main/main.c:2494 #13 0x1147ffa in do_cli /home/shm/src/php-7.0.6/sapi/cli/php_cli.c:974 #14 0x114a5d6 in main /home/shm/src/php-7.0.6/sapi/cli/php_cli.c:1344 #15 0x7ffff401bec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) previously allocated by thread T0 here: #0 0x7ffff4e6041a (/usr/lib/x86_64-linux-gnu/libasan.so.0+0x1541a) #1 0xea6409 in _emalloc /home/shm/src/php-7.0.6/Zend/zend_alloc.c:2446 #2 0xf70872 in zend_list_insert /home/shm/src/php-7.0.6/Zend/zend_list.c:43 #3 0xf70eb5 in zend_register_resource /home/shm/src/php-7.0.6/Zend/zend_list.c:98 #4 0xe05f87 in _php_stream_alloc /home/shm/src/php-7.0.6/main/streams/streams.c:310 #5 0xe1c2a6 in _php_stream_fopen_from_fd_int /home/shm/src/php-7.0.6/main/streams/plain_wrapper.c:178 #6 0xe1c903 in _php_stream_fopen_from_fd /home/shm/src/php-7.0.6/main/streams/plain_wrapper.c:240 #7 0xe1f998 in _php_stream_fopen /home/shm/src/php-7.0.6/main/streams/plain_wrapper.c:998 #8 0xe1fdcc in php_plain_files_stream_opener /home/shm/src/php-7.0.6/main/streams/plain_wrapper.c:1054 #9 0xe0f982 in _php_stream_open_wrapper_ex /home/shm/src/php-7.0.6/main/streams/streams.c:2060 #10 0xc731bb in php_if_fopen /home/shm/src/php-7.0.6/ext/standard/file.c:870 #11 0xaa6c2b in phar_fopen /home/shm/src/php-7.0.6/ext/phar/func_interceptors.c:427 #12 0x101cdbf in ZEND_DO_ICALL_SPEC_HANDLER /home/shm/src/php-7.0.6/Zend/zend_vm_execute.h:586 #13 0x101be38 in execute_ex /home/shm/src/php-7.0.6/Zend/zend_vm_execute.h:414 #14 0x101c093 in zend_execute /home/shm/src/php-7.0.6/Zend/zend_vm_execute.h:458 #15 0xf31421 in zend_execute_scripts /home/shm/src/php-7.0.6/Zend/zend.c:1427 #16 0xdc0beb in php_execute_script /home/shm/src/php-7.0.6/main/main.c:2494 #17 0x1147ffa in do_cli /home/shm/src/php-7.0.6/sapi/cli/php_cli.c:974 #18 0x114a5d6 in main /home/shm/src/php-7.0.6/sapi/cli/php_cli.c:1344 #19 0x7ffff401bec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) SUMMARY: AddressSanitizer: heap-use-after-free /home/shm/src/php-7.0.6/Zend/zend_types.h:827 zval_delref_p Shadow bytes around the buggy address: 0x0c013fffc5d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c013fffc5e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c013fffc5f0: fa fa 00 00 00 01 fa fa fd fd fd fd fa fa fd fd 0x0c013fffc600: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa 0x0c013fffc610: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd =>0x0c013fffc620: fa fa fd fd fd fd fa fa[fd]fd fd fa fa fa 00 00 0x0c013fffc630: 00 fa fa fa 00 00 00 00 fa fa fd fd fd fd fa fa 0x0c013fffc640: 00 00 00 00 fa fa 00 00 00 00 fa fa fd fd fd fd 0x0c013fffc650: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 0x0c013fffc660: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 0x0c013fffc670: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap righ redzone: fb Freed Heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 ASan internal: fe ==10054== ABORTING [Inferior 2 (process 10058) exited normally] ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72155&edit=1