CVE-2019-11042

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its exif extension reads the EXIF metadata that cameras and editing tools embed in JPEG and TIFF images, mostly through exif_read_data().

An Out-of-Bounds Read vulnerability (CVE-2019-11042) has been identified in the EXIF extension's handling of the UserComment tag, which allows an attacker who can supply an image to an application that reads its EXIF data to make PHP read past the end of a heap buffer, which can disclose memory contents or crash the process. PHP tracks this issue as bug #78256.

Per MITRE CWE-125: The product reads data past the end, or before the beginning, of the intended buffer.

This issue affects all versions of PHP before 7.1.31, PHP 7.2 before 7.2.21 and PHP 7.3 before 7.3.8.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/exif)
• Affected versions: <7.1.31, >=7.2.0 <7.2.21, >=7.3.0 <7.3.8
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.1.31, 7.2.21, 7.3.8
  • NES for PHP 5.6.1 (based on PHP 5.6.40)

Vulnerability Info

This Medium-severity vulnerability is found in the exif extension of all PHP versions before 7.1.31, PHP 7.2 before 7.2.21 and 7.3 before 7.3.8, including the End-of-Life PHP 5.6 and 7.0 release lines, which never received the upstream fix. The PHP project scores it 4.8 under CVSS 3.0 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).

The EXIF UserComment tag starts with an 8-byte character code that names its encoding. When the code is UNICODE, exif_process_user_comment() skips those 8 bytes and looks at the next two for a byte-order mark to pick UCS-2 big- or little-endian decoding. In PHP 7.1.30 the function reads:

if (ByteCount>=8) {
    const zend_encoding *from, *to;
    if (!memcmp(szValuePtr, "UNICODE\0", 8)) {
        *pszEncoding = estrdup((const char*)szValuePtr);
        szValuePtr = szValuePtr+8;
        ByteCount -= 8;
        /* First try to detect BOM: ZERO WIDTH NOBREAK SPACE (FEFF 16)
         * since we have no encoding support for the BOM yet we skip that.
         */
        if (!memcmp(szValuePtr, "\xFE\xFF", 2)) {
            decode = "UCS-2BE";
            szValuePtr = szValuePtr+2;
            ByteCount -= 2;

The outer check only guarantees the 8-byte prefix. When the tag holds UNICODE and fewer than two further bytes, the two memcmp() calls read past the end of the value and, when the value sits at the end of the data PHP read from the file, past the end of the heap buffer that holds it. The reporter's AddressSanitizer run shows a 2-byte read just past a 67-byte heap allocation. HeroDevs' analysis also shows that when the bytes just past the value happen to form a byte-order mark, the unfixed code takes it as part of the comment and the conversion then fails. The CVE record describes the result as possible information disclosure or a crash.

Exploitation needs an application that reads EXIF data, for example with exif_read_data(), from an image an attacker supplies, such as a photo upload. Any SAPI is affected. The attacker needs no account on the application beyond what its upload feature requires. Servers that do not load the exif extension, or never read EXIF data from untrusted images, are not exposed.

The fix, by Stanislav Malyshev, checks the byte-order mark only when at least two bytes remain:

if (ByteCount >=2 && !memcmp(szValuePtr, "\xFE\xFF", 2)) {
    decode = "UCS-2BE";
    szValuePtr = szValuePtr+2;
    ByteCount -= 2;
} else if (ByteCount >=2 && !memcmp(szValuePtr, "\xFF\xFE", 2)) {

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6 and 7.0 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, avoid calling exif_read_data() on images from untrusted sources, or disable the exif extension where it is not needed.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.1.31, 7.2.21, 7.3.8, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• orestiskourides (finder)
• Stanislav Malyshev (remediation)