CVE-2019-11036

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its EXIF extension reads the metadata that cameras and editing tools store in JPEG and TIFF images, mainly through the exif_read_data() function.

An Out-of-Bounds Read vulnerability (CVE-2019-11036) has been identified in the exif_process_IFD_TAG() function of PHP's EXIF extension, which allows an attacker who can supply a crafted image to an application that reads its EXIF data to make PHP read past the end of a heap buffer, which can disclose memory contents or crash the process. PHP tracks this issue as bug #77950.

Per MITRE CWE-126: The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

This issue affects PHP before 7.1.29, PHP 7.2 before 7.2.18 and PHP 7.3 before 7.3.5, which includes the End-of-Life PHP 5.6 and 7.0 release lines through their final releases (5.6.40 and 7.0.33).

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/exif)
• Affected versions: <7.1.29, >=7.2.0 <7.2.18, >=7.3.0 <7.3.5
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.1.29, 7.2.18, 7.3.5
  • NES for PHP 5.6.1 (based on PHP 5.6.40)

Vulnerability Info

This Medium-severity vulnerability is found in the EXIF extension of PHP before 7.1.29, 7.2 before 7.2.18 and 7.3 before 7.3.5, including the End-of-Life PHP 5.6 and 7.0 release lines, which never received the upstream fix. The PHP project scores it 4.8 under CVSS 3.0 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) and classifies it as CWE-126, Buffer Over-read. It was found by OSS-Fuzz.

EXIF metadata is organized in Image File Directories (IFDs), whose 12-byte entries each describe one tag. When a tag's value is longer than four bytes, the entry holds an offset to the value instead of the value itself. exif_process_IFD_TAG() computes a pointer from that offset and checks whether the value lies inside the IFD data already in memory. If it does not, the function reads the value from the file instead, after checking it against the file size. Before the fix, the check reads:

if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry || offset_val < (size_t)(dir_entry-offset_base)) {

The check assumes that the directory entry lies after the offset base. A crafted IFD entry whose position is at or before the offset base passed these tests, so the function treated the value as being in memory and copied it from outside the buffer. The AddressSanitizer report on the upstream bug shows a heap-buffer-overflow read of 247 bytes in _estrndup(), called while the tag value was added to the result. The bytes read can end up in the array exif_read_data() returns, which may disclose memory contents, or the read can crash the process.

Exploitation needs an application that reads EXIF data, for example with exif_read_data(), from an image an attacker supplies, such as an uploaded photo. HeroDevs' analysis finds the issue reachable from any server API when the EXIF extension is loaded. Applications that do not load the EXIF extension, or never read EXIF data from untrusted images, are not exposed.

The fix adds one more condition, so that an entry at or before the offset base is never trusted to point into memory and its value is read from the file, within the file's bounds:

if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry || offset_val < (size_t)(dir_entry-offset_base) || dir_entry <= offset_base) {

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6 and 7.0 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, avoid calling exif_read_data() on images from untrusted sources, or disable the EXIF extension if the application does not need it.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.1.29, 7.2.18, 7.3.5, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• OSS-Fuzz (finder)
• Stanislav Malyshev (finder, remediation)