CVE-2019-11041

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its exif extension reads the EXIF metadata that cameras and editors embed in JPEG and TIFF images, including an embedded thumbnail image.

An Out-of-Bounds Read vulnerability (CVE-2019-11041) has been identified in the thumbnail handling of PHP's exif extension, which allows an attacker who can supply an image to an application that reads its EXIF data to make PHP read a few bytes past the end of a heap buffer. PHP tracks this issue as bug #78222.

Per MITRE CWE-125: The product reads data past the end, or before the beginning, of the intended buffer.

This issue affects all versions of PHP before 7.1.31, PHP 7.2 before 7.2.21 and PHP 7.3 before 7.3.8, which includes the End-of-Life PHP 5.6 and 7.0 release lines through their final releases (5.6.40 and 7.0.33).

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/exif)
• Affected versions: <7.1.31, >=7.2.0 <7.2.21, >=7.3.0 <7.3.8
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.1.31, 7.2.21, 7.3.8
  • NES for PHP 5.6.1 (based on PHP 5.6.40)

Vulnerability Info

This Medium-severity vulnerability is found in the exif extension of all PHP versions before 7.1.31, 7.2 before 7.2.21 and 7.3 before 7.3.8, including the End-of-Life PHP 5.6 and 7.0 release lines, which never received the upstream fix. The PHP project scores it 4.8 under CVSS 3.0 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).

When exif_read_data() finds an embedded thumbnail whose width or height is not recorded in the EXIF tags, it calls exif_scan_thumbnail() to parse the thumbnail as a JPEG image and work out its dimensions; exif_thumbnail() does the same when the caller asks for the width and height. The function first checks that the thumbnail starts with the three-byte JPEG signature. In PHP 5.6.40 it begins:

if (!data) {
    return FALSE; /* nothing to do here */
}
if (memcmp(data, "\xFF\xD8\xFF", 3)) {
    if (!ImageInfo->Thumbnail.width && !ImageInfo->Thumbnail.height) {
        exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Thumbnail is not a JPEG image");
    }
    return FALSE;
}

The thumbnail's size comes from the image file and is not checked before this comparison. A thumbnail shorter than the signature makes memcmp() read past the end of the buffer that holds it; the reporter found the overread with AddressSanitizer on a crafted JPEG with a two-byte thumbnail. HeroDevs' analysis confirms that PHP 5.6 scans a one-byte JPEG thumbnail for the signature in the same way.

Exploitation needs an application that reads EXIF data, with thumbnails, from an image an attacker supplies, for example a site that extracts metadata from uploaded photos. This works in any SAPI. The overread is a few bytes, so the CVE record describes the impact as possible information disclosure or a crash. Applications that do not use the exif extension, or never pass untrusted images to it, are not affected.

The fix skips the scan for a thumbnail shorter than four bytes:

if (!data || ImageInfo->Thumbnail.size < 4) {
    return FALSE; /* nothing to do here */
}

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6 and 7.0 are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.1.31, 7.2.21, 7.3.8, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• orestiskourides (finder)
• Stanislav Malyshev (remediation)