CVE-2020-7064

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its EXIF extension reads the metadata that cameras and editing tools store in JPEG and TIFF images, mainly through the exif_read_data() function.

An Out-of-Bounds Read vulnerability (CVE-2020-7064) has been identified in the JPEG parsing code of PHP's EXIF extension, which allows an attacker who can supply a crafted image to an application that reads its EXIF data to make PHP read one byte of uninitialized memory, which could lead to information disclosure or a crash. PHP tracks this issue as bug #79282.

Per MITRE CWE-125: The product reads data past the end, or before the beginning, of the intended buffer.

This issue affects PHP before 7.2.29, PHP 7.3 before 7.3.16 and PHP 7.4 before 7.4.4, which includes every End-of-Life release line from PHP 5.6 through 7.1, each through its final release.

Details

Module Info

• Product: PHP
• Affected packages: php-src (ext/exif)
• Affected versions: <7.2.29, >=7.3.0 <7.3.16, >=7.4.0 <7.4.4
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 7.2.29, 7.3.16, 7.4.4
  • NES for PHP 5.6.1 (based on PHP 5.6.40)

Vulnerability Info

This Medium-severity vulnerability is found in the EXIF extension of PHP before 7.2.29, 7.3 before 7.3.16 and 7.4 before 7.4.4, including every End-of-Life release line from PHP 5.6 through 7.1, which never received the upstream fix. The PHP project scores it 6.5 under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) and classifies it as CWE-125, Out-of-bounds Read. It was found by OSS-Fuzz. The CVE record's description gives the 7.2 bound as 7.2.9, but its list of affected versions and the upstream release give 7.2.29.

In a JPEG file, EXIF data sits in an APP1 section that holds a small TIFF structure. exif_scan_JPEG_header() copies each section into a buffer, and exif_process_TIFF_in_JPEG() starts by reading the two-byte byte-order marker ("II" or "MM") at the start of the TIFF data. Before the fix, the function compared those two bytes without first checking that the data was at least two bytes long:

static void exif_process_TIFF_in_JPEG(image_info_type *ImageInfo, char *CharBuf, size_t length, size_t displacement)
{
    unsigned exif_value_2a, offset_of_ifd;

    /* set the thumbnail stuff to nothing so we can test to see if they get set up */
    if (memcmp(CharBuf, "II", 2) == 0) {
        ImageInfo->motorola_intel = 0;
    } else if (memcmp(CharBuf, "MM", 2) == 0) {
        ImageInfo->motorola_intel = 1;

Sections were also allocated one byte larger than the data copied into them. With an EXIF section whose TIFF data is a single byte, the second byte of the marker comes from that uninitialized extra byte, which MemorySanitizer reported as a use of an uninitialized value. HeroDevs' analysis on PHP 5.6 found that this byte can end up in the result exif_read_data() returns, which matches the record's description of possible information disclosure or a crash.

Exploitation needs an application that reads EXIF data, for example with exif_read_data(), from an image an attacker supplies, such as an uploaded photo. The issue is reachable from any server API when the EXIF extension is loaded. Only one byte of memory is involved, which limits what an attacker can learn. Applications that do not load the EXIF extension, or never read EXIF data from untrusted images, are not exposed.

The fix rejects TIFF data shorter than two bytes with a "Missing TIFF alignment marker" warning, and allocates each section with its real length instead of one extra byte:

if (length < 2) {
    exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Missing TIFF alignment marker");
    return;
}

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 5.6, 7.0 and 7.1 are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, avoid calling exif_read_data() on images from untrusted sources, or disable the EXIF extension if the application does not need it.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 7.2.29, 7.3.16, 7.4.4, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• OSS-Fuzz (finder)
• Nikita Popov (finder)
• Stanislav Malyshev (remediation)