CVE-2019-11035

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its EXIF extension reads the metadata that cameras and editing tools embed in JPEG and TIFF images, through functions such as exif_read_data().

An Out-of-Bounds Read vulnerability (CVE-2019-11035) has been identified in the exif_iif_add_value() function of PHP's EXIF extension, which allows an attacker who can supply an image to an application that reads its EXIF data to make PHP read past the end of a heap buffer, which may disclose memory contents or crash the process. PHP tracks this issue as bug #77831.

Per MITRE CWE-125: The product reads data past the end, or before the beginning, of the intended buffer.

This issue affects all versions of PHP before 7.1.28, PHP 7.2 before 7.2.17 and PHP 7.3 before 7.3.4, which includes the End-of-Life PHP 5.6 and 7.0 release lines through their final releases (5.6.40 and 7.0.33).

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/exif)
• Affected versions: <7.1.28, >=7.2.0 <7.2.17, >=7.3.0 <7.3.4
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.1.28, 7.2.17, 7.3.4
  • NES for PHP 5.6.1 (based on PHP 5.6.40)

Vulnerability Info

This Medium-severity vulnerability is found in the EXIF extension of all PHP versions before 7.1.28, 7.2 before 7.2.17 and 7.3 before 7.3.4, including the End-of-Life PHP 5.6 and 7.0 release lines, which never received the upstream fix. The PHP project scores it 4.8 under CVSS 3.0 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L). It was found by OSS-Fuzz, which reported a heap buffer over-read in exif_iif_add_value() while exif_read_data() parsed a crafted file.

When exif_read_data() parses an image directory (IFD), each tag declares a format (byte, string, short, long, rational, float, double and so on) and a number of components. exif_iif_add_value() then converts the tag's raw value into PHP data. For numeric formats it walks the value one component at a time, advancing by the size of the format, for as many components as the tag declares. The function was never told how many bytes the value really holds. In PHP 5.6.40, the end of that loop reads:

case TAG_FMT_SINGLE:
#ifdef EXIF_DEBUG
    php_error_docref(NULL TSRMLS_CC, E_WARNING, "Found value of type single");
#endif
    info_value->f = *(float *)value;

case TAG_FMT_DOUBLE:
#ifdef EXIF_DEBUG
    php_error_docref(NULL TSRMLS_CC, E_WARNING, "Found value of type double");
#endif
    info_value->d = *(double *)value;
    break;

A tag whose declared size exceeds the bytes the file holds makes the conversion read past the end of the value's heap buffer. The TAG_FMT_SINGLE case also has no break, so a 4-byte float value falls through and is read again as an 8-byte double. The OSS-Fuzz report shows an 8-byte read just past the end of a 47-byte heap allocation. The bytes read past the buffer can end up in the array exif_read_data() returns, which may disclose memory, or the read can crash the process.

Exploitation needs an application that reads EXIF data from an image an attacker supplies, typically an upload, under any SAPI. Applications that do not call the EXIF functions on untrusted files, and builds without the EXIF extension, are not exposed.

The fix passes the real size of the value down to exif_iif_add_value(), so every tag value is copied with the length actually read. String and byte values longer than the data are dropped with a warning, the numeric loop stops when fewer bytes remain than the format needs, and the float case no longer falls through:

vptr_end = value+value_len;
for (idex=0,vptr=value; idex<(size_t)length; idex++,vptr=(char *) vptr + php_tiff_bytes_per_format[format]) {
    if (vptr_end - vptr < php_tiff_bytes_per_format[format]) {
        exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "Value too short");
        break;
    }

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6 and 7.0 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, avoid calling exif_read_data() and the other EXIF functions on images from untrusted sources, or disable the EXIF extension if the application does not need it.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.1.28, 7.2.17, 7.3.4, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• OSS-Fuzz (finder)
• Stanislav Malyshev (finder, remediation)
• Christoph M. Becker (remediation)