oss-security - Re: The GNU C Library security advisories update for 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87bk4r1r71.fsf@oldenburg.str.redhat.com>
Date: Mon, 27 May 2024 12:31:46 +0200
From: Florian Weimer <fweimer@...hat.com>
To: Charles Fol <c.fol@...fo.fr>
Cc: oss-security@...ts.openwall.com
Subject: Re: The GNU C Library security advisories update for
 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix
 out-of-bound writes when writing escape sequence

* Charles Fol:

> Hello all,
>
> Although very late, here is a follow up explaining the impact of the
> vulnerability.
>
> Provided that you can force an application to convert a partially
> controlled buffer to ISO-2022-CN-EXT, you get an
> overflow of 1 to 3 bytes whose value you don't control.
>
> This can be triggered in at least two ways in PHP:
>
> - Through direct calls to iconv()
> - Through the use of PHP filters (i.e. using a "file read" vulnerability)
>
> Due to the way PHP's heap is built, you can use such a memory
> corruption to alter part of a free list pointer,
> which can in turn give you an arbitrary write primitive in the
> program's memory.
>
> With this bug, any person that has a file read vulnerability with a
> controlled prefix on a PHP application has RCE.

Out of curiosity, why would PHP translate a file to ISO-2022-CN-EXT
while reading it?  It's not even an ASCII-transparent charset.

Thanks,
Florian

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.