Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:100876
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain zend.com from 104.47.38.101 cause and error)
To: PHP internals list <internals@lists.php.net>
CC: Stanislav Malyshev <smalyshev@gmail.com>, Nikita Popov <nikic@php.net>,
	Xinchen Hui <laruence@gmail.com>, Sara Golemon <pollita@php.net>, "Zeev
 Suraski" <zeev@zend.com>, "rasmus@lerdorf.com" <rasmus@lerdorf.com>
Thread-Topic: Fix for unserialise() "vulnerabilities"
Thread-Index: AQHTQ2dImWUtX7+w+kqx/QYu0zhQUA==
Date: Thu, 12 Oct 2017 14:38:49 +0000
Message-ID: <BN6PR02MB3234EFDCADFC9F9CF7EF43AEBF4B0@BN6PR02MB3234.namprd02.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: zend.com does not designate
 permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative;
	boundary="_000_BN6PR02MB3234EFDCADFC9F9CF7EF43AEBF4B0BN6PR02MB3234namp_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Oct 2017 14:38:49.7617
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 32210298-c08b-4829-8097-6b12c025a892
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL2PR02MB290
Subject: Fix for unserialise() "vulnerabilities"
From: dmitry@zend.com (Dmitry Stogov)

--_000_BN6PR02MB3234EFDCADFC9F9CF7EF43AEBF4B0BN6PR02MB3234namp_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Hi,


I've found, that at least half of unserialise() security problems, occurs b=
ecause of non-symmetric serialize/unserialize assumption, regarding referen=
ces encoded with "r".


serialize() assumes it's an object.


https://github.com/php/php-src/blob/master/ext/standard/var.c#L828


universalize() allows any value.


https://github.com/php/php-src/blob/master/ext/standard/var_unserializer.re=
#L677


This allows manual crafting of strings that may lead to creation of unexpec=
ted data structures.

I propose to fix this just by fixing the symmetry.


https://gist.github.com/dstogov/53382540bdfee7b6c7dadf142dc437ed


This will prohibit, some manually crafted strings.

Of course, this will break few "security" related tests. Especially:


> Bug #70284 (Use after free vulnerability in unserialize() with GMP) [ext/=
gmp/tests/bug70284.phpt]
> Bug #70211 (php 7 ZEND_HASH_IF_FULL_DO_RESIZE use after free) [ext/soap/t=
ests/bug70211.phpt]
> Bug #70172 - Use After Free Vulnerability in unserialize() [ext/standard/=
tests/serialize/bug70172.phpt]
> Bug #70963 (Unserialize shows UNKNOW in result) [ext/standard/tests/seria=
lize/bug70963.phpt]
> Memleaks if unserialize return a self-referenced array/object [ext/standa=
rd/tests/serialize/unserialize_mem_leak.phpt]
> Bug #72433: Use After Free Vulnerability in PHP's GC algorithm and unseri=
alize [ext/standard/tests/strings/bug72433.phpt]

Any objections? (this is for master only of course)


Thanks. Dmitry.

--_000_BN6PR02MB3234EFDCADFC9F9CF7EF43AEBF4B0BN6PR02MB3234namp_--