CVE-2019-11040

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its exif extension reads the EXIF metadata, including embedded thumbnail images, that cameras and editing tools store in JPEG and TIFF files.

An Out-of-Bounds Read vulnerability (CVE-2019-11040) has been identified in the thumbnail parsing code of PHP's exif extension, which allows an attacker who can supply an image to an application that reads its EXIF data with thumbnails to make PHP read past the end of a heap buffer, which can disclose memory contents or crash the process. PHP tracks this issue as bug #77988.

Per MITRE CWE-125: The product reads data past the end, or before the beginning, of the intended buffer.

This issue affects all versions of PHP before 7.1.30, PHP 7.2 before 7.2.19 and PHP 7.3 before 7.3.6, which includes the End-of-Life release lines PHP 5.6 and 7.0 through their final releases (5.6.40 and 7.0.33).

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/exif)
• Affected versions: <7.1.30, >=7.2.0 <7.2.19, >=7.3.0 <7.3.6
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.1.30, 7.2.19, 7.3.6
  • NES for PHP 5.6.1 (based on PHP 5.6.40)

Vulnerability Info

This Medium-severity vulnerability is found in the exif extension of all versions of PHP before 7.1.30, PHP 7.2 before 7.2.19 and PHP 7.3 before 7.3.6, including the End-of-Life PHP 5.6 and 7.0 release lines, which never received the upstream fix. The PHP project scores it 4.8 under CVSS 3.0 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).

When an image carries an embedded JPEG thumbnail and the application asks for it (for example exif_read_data() with thumbnail reading enabled, or exif_thumbnail() with its width and height arguments), and the thumbnail's dimensions are not already known, PHP calls exif_scan_thumbnail() to walk the thumbnail's JPEG markers and find its size. Each marker is followed by a two-byte segment length, which the function reads with php_jpg_get16(). In PHP 5.6.40, the loop reads:

n = 8;
while ((c = data[pos++]) == 0xFF && n--) {
    if (pos+3>=ImageInfo->Thumbnail.size)
        return FALSE;
    /* +3 = pos++ of next check when reaching marker + 2 bytes for length */
}
if (c == 0xFF)
    return FALSE;
marker = c;
length = php_jpg_get16(data+pos);
if (pos+length>=ImageInfo->Thumbnail.size) {
    return FALSE;
}

After the marker byte has been consumed, nothing checks that pos is still inside the thumbnail before the two length bytes are read. A thumbnail that is truncated right after a marker makes php_jpg_get16() read past the end of the heap buffer that holds it. The reporter demonstrated the over-read with AddressSanitizer. The CVE record states that this may lead to information disclosure or a crash.

Any application that reads EXIF data, with thumbnails, from an image an attacker supplies can be exposed, under any SAPI, for example a site that processes uploaded photos. Applications that do not use the exif extension, or that only read EXIF data from trusted images, are not affected.

The fix stops the scan when the position has reached the end of the thumbnail, before the segment length is read:

marker = c;
if (pos>=ImageInfo->Thumbnail.size)
    return FALSE;
length = php_jpg_get16(data+pos);

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6 and 7.0 are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.1.30, 7.2.19, 7.3.6, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• orestiskourides (finder)
• Stanislav Malyshev (remediation)