Bug #81701 [Opn->Dup]: Memory Corruption vulnerability on Zend_execute_api
| From: | cmb@php.net | Date: | Fri, 17 Dec 2021 18:31:08 +0000 |
| Subject: | Bug #81701 [Opn->Dup]: Memory Corruption vulnerability on Zend_execute_api | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-238469@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=81701&edit=1
ID: 81701
Updated by: cmb@php.net
Reported by: 3ntr0py1337 at gmail dot com
Summary: Memory Corruption vulnerability on Zend_execute_api
-Status: Open
+Status: Duplicate
Type: Bug
Package: Reproducible crash
Operating System: Ubuntu 20.04.3 LTS
PHP Version: Next Major Version
-Assigned To:
+Assigned To: cmb
Block user comment: N
Private report: N
New Comment:
Simpler reproducer:
<?php
class Test
{
function __toString()
{
return $this;
}
}
echo new Test();
?>
As such, this is a duplicate of bug #64196.
Previous Comments:
------------------------------------------------------------------------
[2021-12-17 12:56:26] 3ntr0py1337 at gmail dot com
Description:
------------
There is a memory corruption vulnerability which would overwrite the Stack pointer causing a crash.
with proper control, can lead to RCE
Test script:
---------------
Sample 1 - source code
--TEST--
ZE2 __toString() in __destruct
--FILE--
<?php
class Test
{
function __toString()
{
return "He echo $this;
}
}
$o = nello\n";
}
function __destruct()
{
echo $this;
}
}
$o = new Test%
$o = NULL;
$o = new Test;
?>
====DONE====
--EXPECT--
Hello
====DONE====
Hello
Expected result:
----------------
EFLAGS: 0x10206 (carry PARITY adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x555556342667 <zend_call_function+103>: je 0x5555563460f0
<zend_call_function+15088>
0x55555634266d <zend_call_function+109>: nop DWORD PTR [rax]
0x555556342670 <zend_call_function+112>: lea rsp,[rsp-0x98]
=> 0x555556342678 <zend_call_function+120>: mov QWORD PTR [rsp],rdx
0x55555634267c <zend_call_function+124>: mov QWORD PTR [rsp+0x8],rcx
0x555556342681 <zend_call_function+129>: mov QWORD PTR [rsp+0x10],rax
0x555556342686 <zend_call_function+134>: mov rcx,0x643c
0x55555634268d <zend_call_function+141>: call 0x555556351980 <__afl_maybe_log>
[------------------------------------stack-------------------------------------]
Invalid $SP address: 0x7fffff7fefe8
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x0000555556342678 in zend_call_function (fci=0x7fffff7ff180, fci_cache=0x7fffff7ff160) at
/home/ubuntu/victims/php-src/Zend/zend_execute_API.c:730
730 if (!fci_cache || !fci_cache->function_handler) {
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=81701&edit=1