CVE-2019-9639

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its EXIF extension reads the metadata that cameras and editing tools store in JPEG and TIFF images, including the vendor-specific maker note, through functions such as exif_read_data() and exif_thumbnail().

An Information Exposure vulnerability (CVE-2019-9639) has been identified in the exif_process_IFD_in_MAKERNOTE() function of PHP's EXIF extension, which allows an attacker who can supply a crafted image to an application that reads its EXIF data to make PHP process the image's maker note with an uninitialized data length, so that the parser can read memory outside the maker note. PHP tracks this issue as bug #77659.

Per MITRE CWE-908: The product uses or accesses a resource that has not been initialized.

This issue affects PHP 5.6.37 through 5.6.40, PHP 7.0.31 through 7.0.33, PHP 7.1.20 through 7.1.26, PHP 7.2.8 through 7.2.15 and PHP 7.3.0 through 7.3.2, where 5.6.40 and 7.0.33 are the final releases of the End-of-Life PHP 5.6 and 7.0 release lines.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/exif)
• Affected versions: >=5.6.37 <=5.6.40, >=7.0.31 <=7.0.33, >=7.1.20 <7.1.27, >=7.2.8 <7.2.16, >=7.3.0 <7.3.3
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.1.27, 7.2.16, 7.3.3
  • NES for PHP 5.6.1 (based on PHP 5.6.40)

Vulnerability Info

This High-severity vulnerability is found in the EXIF extension of PHP 5.6.37 through 5.6.40, 7.0.31 through 7.0.33, 7.1.20 through 7.1.26, 7.2.8 through 7.2.15 and 7.3.0 through 7.3.2, including the End-of-Life PHP 5.6 and 7.0 release lines, which never received the upstream fix. Earlier releases are not affected: the length variable that is left uninitialized was introduced by the fix for bug #76557 in PHP 5.6.37, 7.0.31, 7.1.20 and 7.2.8. The CVE record, assigned by MITRE, carries no CVSS score, and CISA-ADP gives none either; NVD scores it 7.5 under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and classifies it as CWE-908, Use of Uninitialized Resource. It is a separate flaw in the same function as CVE-2019-9638, and both were fixed in the same upstream releases.

Many cameras store vendor-specific data in a maker note, which PHP parses as a nested Image File Directory. exif_process_IFD_in_MAKERNOTE() sets a data length according to the maker note's offset mode, then passes that length to exif_process_IFD_TAG() as the size of the data it may read tag values from. The MN_OFFSET_MAKER and MN_OFFSET_GUESS modes set it, but before the fix the default mode did not:

    default:
    case MN_OFFSET_NORMAL:
        break;
}

data_len is a local variable declared without a value, so for a maker note in the default mode the bounds checks on each tag were made against whatever the stack held. The reporter's Valgrind output shows a conditional jump that depends on an uninitialized value in exif_process_IFD_TAG(). Depending on that value, the checks may let a tag's offset and length point past the maker note, and the parser can then read and return memory outside it, which NVD rates as a high confidentiality impact.

Exploitation needs an application that reads EXIF data, for example with exif_read_data() or exif_thumbnail(), from an image an attacker supplies, such as an uploaded photo. HeroDevs' analysis finds the issue reachable from any server API when the EXIF extension is loaded. Applications that do not load the EXIF extension, or never read EXIF data from untrusted images, are not exposed.

The fix sets the data length in the default mode to the maker note's own length, so tag values are checked against the real size of the maker note:

default:
case MN_OFFSET_NORMAL:
    data_len = value_len;
    break;

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6 and 7.0 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, avoid reading EXIF data from images from untrusted sources, or disable the EXIF extension if the application does not need it.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.1.27, 7.2.16, 7.3.3, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• chamal.desilva (finder)
• Stanislav Malyshev (remediation)