CVE-2019-9638

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its EXIF extension reads the metadata that cameras and editing tools embed in JPEG and TIFF images, through functions such as exif_read_data() and exif_thumbnail().

An Out-of-Bounds Read vulnerability (CVE-2019-9638) has been identified in the exif_process_IFD_in_MAKERNOTE() function of PHP's EXIF extension, which allows an attacker who can supply an image to an application that reads its EXIF data to make PHP read uninitialized memory just past the end of the image's maker note. PHP tracks this issue as bug #77563.

Per MITRE CWE-125: The product reads data past the end, or before the beginning, of the intended buffer.

This issue affects PHP before 7.1.27, PHP 7.2 before 7.2.16 and PHP 7.3 before 7.3.3, which includes the End-of-Life PHP 5.6 release line through its final release (5.6.40).

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/exif)
• Affected versions: <7.1.27, >=7.2.0 <7.2.16, >=7.3.0 <7.3.3
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.1.27, 7.2.16, 7.3.3
  • NES for PHP 5.6.1 (based on PHP 5.6.40)

Vulnerability Info

This High-severity vulnerability is found in the EXIF extension of PHP before 7.1.27, 7.2 before 7.2.16 and 7.3 before 7.3.3, including the End-of-Life PHP 5.6 release line, which never received the upstream fix. The CVE record, assigned by MITRE, has no CVSS score and no CWE; NVD scores it 7.5 under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

A maker note is a vendor-specific block inside a photo's EXIF data. For cameras it recognizes, PHP's EXIF extension parses the maker note as another image directory (IFD) that starts at a fixed offset inside the maker note's value. Before reading the directory, exif_process_IFD_in_MAKERNOTE() checks that the offset lies inside the value, then reads the directory's two-byte entry count from that position. In PHP 5.6.40:

if (maker_note->offset >= value_len) {
    /* Do not go past the value end */
    exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
    return FALSE;
}

dir_start = value_ptr + maker_note->offset;

The check only ensures that the first byte of the directory is inside the value. When the offset is exactly one less than the value's length, php_ifd_get16u() reads the entry count's second byte from past the end of the value. The reporter showed with Valgrind that this byte is uninitialized memory, and that later decisions in the function depend on it. The entry count, and therefore how the rest of the maker note is parsed, can then come from memory that does not belong to the image.

Exploitation needs an application that reads EXIF data with exif_read_data(), read_exif_data() or exif_thumbnail() from an image an attacker supplies, typically an upload, under any SAPI. The image must carry a maker note for one of the camera makers PHP recognizes. Applications that do not run the EXIF functions on untrusted files, and builds without the EXIF extension, are not exposed.

The fix requires the maker note's directory to start at least two bytes before the end of the value, so both bytes of the entry count are inside it:

if (value_len < 2 || maker_note->offset >= value_len - 1) {

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6 and 7.0 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, avoid calling exif_read_data(), exif_thumbnail() and the other EXIF functions on images from untrusted sources, or disable the EXIF extension if the application does not need it.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.1.27, 7.2.16, 7.3.3, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• chamal.desilva (finder)
• Stanislav Malyshev (remediation)