Bug #80959 [NEW]: infinite loop in building cfg during JIT compilation
| From: | zengyhkyle at asu dot edu | Date: | Thu, 15 Apr 2021 22:32:33 +0000 |
| Subject: | Bug #80959 [NEW]: infinite loop in building cfg during JIT compilation | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-233447@lists.php.net to get a copy of this message | ||
From: zengyhkyle at asu dot edu
Operating system: Linux
PHP version: 8.0.3
Package: JIT
Bug Type: Bug
Bug description:infinite loop in building cfg during JIT compilation
Description:
------------
if JIT compilation is enabled, PHP will get stuck in infinitely during
loop identification when building the cfg for some code.
the configuration we use is listed as follow:
~~~
opcache.jit_debug=263
opcache.enable_cli=1
opcache.jit=1205
opcache.jit_buffer_size=1G
zend_extension=/home/user/php-src-php-8.0.3/modules/opcache.so
~~~
This vulnerability is found by Yihui Zeng, Jayakrishna Menon, Steven
Wirsz, and Gokul Krishna P from Arizona State University for class
CSE598 Applied Vulnerability Research
a poc is attached.
Test script:
---------------
<?php
$v0 = -815;
$v1 = True;
$v2 = $v0;
if($v1){
$v3 = [5, 5];
$v2 = $v3;
}else{
$v4 = False;
$v5 = $v0;
if($v4){
$v6 = $v4|$v0;
$v5 = $v6;
}else{
$v5 = $v5 + 1;
$v7 = $v5 + 1;
$v5 = $v7;
}
$v2 = $v5;
}
$v8 = 0;
$v9 = 4;
$v10 = $v8;
do{
$v10 = $v10 + 1;
$v11 = $v10 + 1;
$v12 = $v10;
try{
continue;
$v10 = $v12;
}catch(Exception $e){
$v2 = $v12;
}
$v13 = False;
$v14 = $v13;
if($v13){
$v15 = $v12/$v14;
$v14 = $v15;
}else{
$v16 = 0;
$v17 = 9;
$v18 = $v16;
do{
$v18 = $v18 + 1;
$v19 = $v18 + 1;
$v19 = $v19 - 1;
$v20 = $v19 - 1;
}while($v18<$v17);
$v21 = "kBBqSjjO63";
$v21[0] = $v12;
$v14 = $v21;
}
}while($v10<$v9);
$v22 = [3.055141489223973, 5.118032201755781, 1.6115282496633003,
2.796353888054253, 1.607762036181039, 5.52005061408927,
2.4609577104054896];
$v23 = [4, 1, 4, 4];
echo "Done";
?>
--
Edit bug report at https://bugs.php.net/bug.php?id=80959&edit=1
--
Fix committed: https://bugs.php.net/fix.php?id=80959&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=80959&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=80959&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=80959&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=80959&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=80959&r=support
Expected behavior: https://bugs.php.net/fix.php?id=80959&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=80959&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=80959&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=80959&r=globals
PHP version support discontinued: https://bugs.php.net/fix.php?id=80959&r=phptooold
Daylight Savings: https://bugs.php.net/fix.php?id=80959&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=80959&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=80959&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=80959&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=80959&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=80959&r=mysqlcfg