CVE-2019-13224

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its mbstring extension provides multibyte-aware string and regular expression functions, and in these release lines it ships a copy of the Oniguruma regular expression library for its mb_ereg family of functions.

A Use After Free vulnerability (CVE-2019-13224) has been identified in the onig_new_deluxe() function of the Oniguruma library bundled with PHP's mbstring extension, which allows code that compiles a regular expression whose pattern encoding differs from its target encoding to use memory after it has been freed. In PHP 5.6, PHP's own functions do not call onig_new_deluxe(), so the flaw sits in the bundled library rather than in a path PHP scripts can reach. PHP tracks this issue as bug #78380.

Per MITRE CWE-416: The product reuses or references memory after it has been freed.

This issue affects all versions of PHP before 7.1.32, PHP 7.2 before 7.2.22 and PHP 7.3 before 7.3.9, in builds of the mbstring extension that use the Oniguruma library bundled with PHP.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/mbstring/oniguruma)
• Affected versions: <7.1.32, >=7.2.0 <7.2.22, >=7.3.0 <7.3.9
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.1.32, 7.2.22, 7.3.9
  • NES for PHP 5.6.1 (based on PHP 5.6.40)

Vulnerability Info

This Critical-severity vulnerability is found in the copy of the Oniguruma regular expression library that PHP bundles with its mbstring extension, in all PHP versions before 7.1.32, PHP 7.2 before 7.2.22 and PHP 7.3 before 7.3.9, including the End-of-Life PHP 5.6 and 7.0 release lines, which never received the fix. PHP 7.4 and later no longer bundle Oniguruma. The CVE record was assigned by MITRE for Oniguruma 6.9.2 and carries no CVSS score, and CISA-ADP has not added one; NVD scores it 9.8 under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

onig_new_deluxe() compiles a regular expression from a compile-info structure that names a pattern encoding and a target encoding. When the two differ, it first converts the pattern into a newly allocated buffer, compiles that buffer, and frees it afterwards. In PHP 7.1.31 the bundled function reads:

if (ci->pattern_enc != ci->target_enc) {
  r = conv_encoding(ci->pattern_enc, ci->target_enc, pattern, pattern_end,
                    &cpat, &cpat_end);
  if (r) return r;
}
else {
  cpat = (UChar* )pattern;
  cpat_end = (UChar* )pattern_end;
}

The CVE record describes a use after free in this conversion path: with a crafted pattern and subject string in a multi-byte encoding, the converted pattern can be used after onig_new_deluxe() has freed it. The record says this can potentially lead to information disclosure, denial of service, or possibly code execution.

HeroDevs' analysis found that the mbstring extension in PHP 5.6 compiles its patterns with onig_new() and never calls onig_new_deluxe(), so PHP functions such as mb_ereg() do not reach the flaw there. Only native code that links against PHP's bundled Oniguruma and calls onig_new_deluxe() itself is exposed.

The fix, which Stanislav Malyshev backported to PHP from K.Kosako's Oniguruma change, removes the conversion: onig_new_deluxe() now refuses a pattern and target with different encodings:

if (ci->pattern_enc != ci->target_enc) {
  return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION;
}

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6 and 7.0 are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.1.32, 7.2.22, 7.3.9, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• Christoph M. Becker (remediation)
• K.Kosako (remediation)
• Stanislav Malyshev (remediation)