CVE-2019-11050

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its exif extension reads the EXIF metadata that cameras and editors embed in JPEG and TIFF images, including the vendor-specific maker notes that some cameras add.

An Out-of-Bounds Read vulnerability (CVE-2019-11050) has been identified in the maker note parser of PHP's exif extension, which allows an attacker who can supply an image to an application that reads its EXIF data to make PHP read past the end of the buffer that holds the maker note. PHP tracks this issue as bug #78793.

Per MITRE CWE-125: The product reads data past the end, or before the beginning, of the intended buffer.

This issue affects all versions of PHP before 7.2.26, PHP 7.3 before 7.3.13 and PHP 7.4.0, including the End-of-Life PHP 5.6, 7.0 and 7.1 release lines through their final releases (5.6.40, 7.0.33 and 7.1.33), which contain the same maker note code.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/exif)
• Affected versions: <7.2.26, >=7.3.0 <7.3.13, >=7.4.0 <7.4.1
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.2.26, 7.3.13, 7.4.1
  • NES for PHP 5.6.1 (based on PHP 5.6.40)

Vulnerability Info

This Medium-severity vulnerability is found in the exif extension of all PHP versions before 7.2.26, 7.3 before 7.3.13 and 7.4.0. The End-of-Life PHP 5.6, 7.0 and 7.1 release lines, which never received the upstream fix, contain the same code. The PHP project scores it 4.8 under CVSS 3.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L).

Many cameras store vendor data in an EXIF maker note, which is itself a small directory of 12-byte tag entries. exif_process_IFD_in_MAKERNOTE() walks those entries and passes each one to exif_process_IFD_TAG() together with the length of the data the tag value may be read from. In PHP 5.6.40 the loop reads:

for (de=0;de<NumDirEntries;de++) {
    if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
                              offset_base, data_len, displacement, section_index, 0, maker_note->tag_table TSRMLS_CC)) {
        return FALSE;
    }
}

Every entry receives the length of the whole maker note, not the length that remains after the entry. A crafted maker note can therefore describe a tag value that lies past the end of the maker note buffer, and PHP reads it. Nikita Popov found the issue as a use of freed memory under MemorySanitizer while parsing one of PHP's own test images. The CVE record describes the impact as possible information disclosure or a crash.

Exploitation needs an application that reads EXIF data from an image an attacker supplies, for example a site that extracts metadata from uploaded photos. This works in any SAPI. Applications that do not use the exif extension, or never pass untrusted images to it, are not affected.

The fix passes each entry the length that remains after it:

for (de=0;de<NumDirEntries;de++) {
    size_t offset = 2 + 12 * de;
    if (!exif_process_IFD_TAG(ImageInfo, dir_start + offset,
                              offset_base, data_len - offset, displacement, section_index, 0, maker_note->tag_table)) {
        return FALSE;
    }
}

PHP 5.6 still compiles the guessed-offset mode for maker notes, used for Canon cameras, which upstream disabled in PHP 7.2.0, before this fix. In that mode the guessed data length can be shorter than an entry's offset, so the upstream change alone would make the remaining length wrap around and let a crafted Canon maker note read past its buffer. The NES for PHP 5.6 fix therefore also rejects such an entry with an "Illegal IFD offset" warning.

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0 and 7.1 are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.2.26, 7.3.13, 7.4.1, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Nikita Popov (finder)
• Stanislav Malyshev (remediation)