CVE-2019-11047

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its EXIF extension reads the metadata that cameras embed in JPEG and TIFF images, through functions such as exif_read_data().

An Out-of-Bounds Read vulnerability (CVE-2019-11047) has been identified in exif_process_IFD_in_MAKERNOTE(), part of PHP's EXIF extension, which allows an attacker who supplies a crafted image to make exif_read_data() read past the end of a heap buffer, which can disclose memory contents or crash the process. PHP tracks this issue as bug #78910.

Per MITRE CWE-125: The product reads data past the end, or before the beginning, of the intended buffer.

This issue affects all versions of PHP before 7.2.26, PHP 7.3 before 7.3.13 and PHP 7.4.0, including the End-of-Life release lines PHP 5.6, 7.0 and 7.1 through their final releases (5.6.40, 7.0.33 and 7.1.33).

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/exif)
• Affected versions: <7.2.26, >=7.3.0 <7.3.13, >=7.4.0 <7.4.1
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.2.26, 7.3.13, 7.4.1
  • NES for PHP 5.6.1 (based on PHP 5.6.40)

Vulnerability Info

This Medium-severity vulnerability is found in the exif extension of PHP before 7.2.26, 7.3 before 7.3.13 and 7.4.0, including the End-of-Life PHP 5.6, 7.0 and 7.1 release lines, which never received the upstream fix. The PHP project scores it 4.8 under CVSS 3.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).

Camera makers store vendor-specific data in a MakerNote tag. To parse it, exif_process_IFD_in_MAKERNOTE() looks up the camera's make and model in a table of known formats, and for some formats it also checks that the maker note begins with an expected ID string. In PHP 5.6.40 that lookup reads:

if (maker_note->make && (!ImageInfo->make || strcmp(maker_note->make, ImageInfo->make)))
    continue;
if (maker_note->model && (!ImageInfo->model || strcmp(maker_note->model, ImageInfo->model)))
    continue;
if (maker_note->id_string && strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
    continue;
break;

The ID comparison reads id_string_len bytes from the maker note value without checking that the value is that long. A maker note shorter than the maker's ID string makes strncmp() read past the end of the heap buffer that holds it. The issue was found by OSS-Fuzz, Google's continuous fuzzing service.

Exploitation needs an application that reads EXIF data, for example with exif_read_data(), from an image an attacker supplies, such as an uploaded photo. Any SAPI is affected. The over-read is small and the CVSS score reflects a limited impact: some disclosure of adjacent memory or a crash of the PHP process.

The fix compares the ID only when the maker note is at least as long as the ID string:

if (maker_note->id_string && value_len >= maker_note->id_string_len
        && strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
    continue;

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0 and 7.1 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, avoid calling exif_read_data() on untrusted images, or disable the exif extension where it is not needed.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.2.26, 7.3.13, 7.4.1, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• OSS-Fuzz (finder)
• Stanislav Malyshev (remediation)