CVE-2019-11034

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its EXIF extension reads the metadata that cameras and editing tools embed in JPEG and TIFF images, through functions such as exif_read_data().

An Out-of-Bounds Read vulnerability (CVE-2019-11034) has been identified in the maker note parser of PHP's EXIF extension, which allows an attacker who can supply an image that an application passes to exif_read_data() to make PHP read past the end of a heap buffer, which may disclose memory contents or crash the process. PHP tracks this issue as bug #77753.

Per MITRE CWE-125: The product reads data past the end, or before the beginning, of the intended buffer.

This issue affects PHP 7.1 before 7.1.28, PHP 7.2 before 7.2.17 and PHP 7.3 before 7.3.4, as well as the End-of-Life release lines PHP 5.6 and 7.0 through their final releases (5.6.40 and 7.0.33).

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/exif)
• Affected versions: <7.1.28, >=7.2.0 <7.2.17, >=7.3.0 <7.3.4
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.1.28, 7.2.17, 7.3.4
  • NES for PHP 5.6.1 (based on PHP 5.6.40)

Vulnerability Info

This Medium-severity vulnerability is found in the EXIF extension of PHP 7.1 before 7.1.28, 7.2 before 7.2.17 and 7.3 before 7.3.4, and in the End-of-Life PHP 5.6 and 7.0 release lines, which never received the upstream fix. The PHP project scores it 4.8 under CVSS 3.0 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).

Many cameras store vendor-specific data in a maker note, a tag whose value is itself a small directory of further tags. PHP parses it in exif_process_IFD_in_MAKERNOTE(), which sets dir_start to the start of the tag's value plus an offset that depends on the camera vendor, reads the number of entries from there, and then hands each 12-byte entry to exif_process_IFD_TAG(). In PHP 7.1.27, the only size check before that loop reads:

if ((2+NumDirEntries*12) > value_len) {
    exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
    return FALSE;
}

for (de=0;de<NumDirEntries;de++) {
    if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
                              offset_base, data_len, displacement, section_index, 0, maker_note->tag_table)) {
        return FALSE;
    }
}

The check compares the size of the directory with the whole length of the value, but the directory does not start at the beginning of the value: it starts at dir_start. When a crafted maker note places a directory near the end of its value, the directory passes the check yet runs past the end of the buffer, and reading its entries (for example in php_ifd_get32s()) reads heap memory beyond the allocation. The issue was found by OSS-Fuzz, which reported it as a heap buffer overflow on read.

Exploitation needs an application that reads EXIF data from an image an attacker supplies, such as a profile picture or gallery upload processed with exif_read_data(), under any server API. According to the CVE record, the over-read may lead to information disclosure or a crash. Applications that do not use the EXIF extension, or that only read EXIF data from trusted images, are not exposed.

The fix adds a second check that takes the directory's offset inside the value into account, so a directory that does not fit between its start and the end of the value is rejected with an "Illegal IFD size" warning:

if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
    exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
    return FALSE;
}

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6 and 7.0 are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.1.28, 7.2.17, 7.3.4, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• OSS-Fuzz (finder)
• Stanislav Malyshev (remediation)