|
| Reporter | ilia | Assigned To | | |
|---|
| Priority | normal | Severity | crash | Reproducibility | always |
|---|
| Status | closed | Resolution | fixed | |
|---|
| Product Version | 3.5.1 | |
|---|
| Target Version | 3.5dev | Fixed in Version | 3.5.3 | |
|---|
|
| Summary | 0002421: Crash with wrong option letter in DBGP and socket commands |
|---|
| Description | xdebug_cmd_parse uses *ptr - 'a' as index into 27-slot args->value[] with no range check.
Any byte outside [a-z] (and not '-') lands args->value[opt_index] = xdebug_str_create(...) at an attacker-chosen signed offset off a 216-byte heap allocation.
Fix: reject bytes outside [a-z] | '-' in STATE_OPT_FOLLOWS before opt - 'a' is used (test in patch) |
|---|
| Steps To Reproduce |
- Start
victim.php (xdebug.mode=develop, xdebug.control_socket=default).
- Run
attacker.php; it opens @xdebug-ctrl.<PID> and sends "ps -\x80 x".
- Victim crashes inside xdebug_cmd_parse.
run.sh orchestrates both. Edit PHP=, XDEBUG_SO=, ATTACKER_PHP= at the top. |
|---|
| Additional Information | pid=278109
=================================================================
==278109==ERROR: AddressSanitizer: heap-use-after-free on address 0x511000001738 at pc 0x7d32ae23d7d6 bp 0x7ffc51fc0c20 sp 0x7ffc51fc0c10
READ of size 8 at 0x511000001738 thread T0
#0 0x7d32ae23d7d5 in xdebug_cmd_parse /home/ilia/xdebug/src/lib/cmd_parser.c:115
#1 0x7d32ae22e5f4 in handle_command /home/ilia/xdebug/src/base/ctrl_socket.c:142
#2 0x7d32ae2304b4 in xdebug_control_socket_handle /home/ilia/xdebug/src/base/ctrl_socket.c:297
#3 0x7d32ae230829 in xdebug_control_socket_dispatch /home/ilia/xdebug/src/base/ctrl_socket.c:426
#4 0x7d32ae216498 in xdebug_statement_call /home/ilia/xdebug/xdebug.c:716
#5 0x58c67dfed6be in zend_extension_statement_handler /home/ilia/php-src-8.4/Zend/zend_execute.c:2356
#6 0x58c67e4f2f5f in zend_llist_apply_with_argument /home/ilia/php-src-8.4/Zend/zend_llist.c:236
#7 0x58c67e04cb73 in ZEND_EXT_STMT_SPEC_HANDLER /home/ilia/php-src-8.4/Zend/zend_vm_execute.h:3078
#8 0x58c67e32dfaf in execute_ex /home/ilia/php-src-8.4/Zend/zend_vm_execute.h:59002
#9 0x7d32ae2279e2 in xdebug_execute_ex /home/ilia/xdebug/src/base/base.c:888
#10 0x58c67e34d530 in zend_execute /home/ilia/php-src-8.4/Zend/zend_vm_execute.h:64334
#11 0x58c67e5eae30 in zend_execute_script /home/ilia/php-src-8.4/Zend/zend.c:1934
#12 0x58c67da81fff in php_execute_script_ex /home/ilia/php-src-8.4/main/main.c:2577
#13 0x58c67da826c9 in php_execute_script /home/ilia/php-src-8.4/main/main.c:2617
#14 0x58c67e5f3418 in do_cli /home/ilia/php-src-8.4/sapi/cli/php_cli.c:935
#15 0x58c67e5f60b1 in main /home/ilia/php-src-8.4/sapi/cli/php_cli.c:1322
#16 0x7d32b4429d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#17 0x7d32b4429e3f in __libc_start_main_impl ../csu/libc-start.c:392
#18 0x58c67ca057c4 in _start (/home/ilia/php-src-8.4/sapi/cli/php+0x28057c4)
0x511000001738 is located 120 bytes inside of 216-byte region [0x5110000016c0,0x511000001798)
freed by thread T0 here:
#0 0x7d32b52b4c38 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
#1 0x7d32ae23637d in xdebug_explode /home/ilia/xdebug/src/lib/usefulstuff.c:123
#2 0x7d32ae22ace4 in read_systemd_private_tmp_directory /home/ilia/xdebug/src/base/base.c:1252
#3 0x7d32ae22b3ec in xdebug_base_minit /home/ilia/xdebug/src/base/base.c:1323
#4 0x7d32ae215e68 in zm_startup_xdebug /home/ilia/xdebug/xdebug.c:515
#5 0x58c67de21b34 in zend_startup_module_ex /home/ilia/php-src-8.4/Zend/zend_API.c:2446
#6 0x58c67de30309 in zend_startup_module /home/ilia/php-src-8.4/Zend/zend_API.c:3266
#7 0x7d32ae2168b6 in xdebug_zend_startup /home/ilia/xdebug/xdebug.c:745
#8 0x58c67e354ac8 in zend_extension_startup /home/ilia/php-src-8.4/Zend/zend_extensions.c:196
#9 0x58c67e4f1ad3 in zend_llist_apply_with_del /home/ilia/php-src-8.4/Zend/zend_llist.c:171
#10 0x58c67e354b53 in zend_startup_extensions /home/ilia/php-src-8.4/Zend/zend_extensions.c:218
#11 0x58c67da7ffbe in php_module_startup /home/ilia/php-src-8.4/main/main.c:2292
#12 0x58c67e5ef83c in php_cli_startup /home/ilia/php-src-8.4/sapi/cli/php_cli.c:397
#13 0x58c67e5f5ebb in main /home/ilia/php-src-8.4/sapi/cli/php_cli.c:1289
#14 0x7d32b4429d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
previously allocated by thread T0 here:
#0 0x7d32b52b4c38 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
#1 0x7d32ae23637d in xdebug_explode /home/ilia/xdebug/src/lib/usefulstuff.c:123
#2 0x7d32ae22ace4 in read_systemd_private_tmp_directory /home/ilia/xdebug/src/base/base.c:1252
#3 0x7d32ae22b3ec in xdebug_base_minit /home/ilia/xdebug/src/base/base.c:1323
#4 0x7d32ae215e68 in zm_startup_xdebug /home/ilia/xdebug/xdebug.c:515
#5 0x58c67de21b34 in zend_startup_module_ex /home/ilia/php-src-8.4/Zend/zend_API.c:2446
#6 0x58c67de30309 in zend_startup_module /home/ilia/php-src-8.4/Zend/zend_API.c:3266
#7 0x7d32ae2168b6 in xdebug_zend_startup /home/ilia/xdebug/xdebug.c:745
#8 0x58c67e354ac8 in zend_extension_startup /home/ilia/php-src-8.4/Zend/zend_extensions.c:196
#9 0x58c67e4f1ad3 in zend_llist_apply_with_del /home/ilia/php-src-8.4/Zend/zend_llist.c:171
#10 0x58c67e354b53 in zend_startup_extensions /home/ilia/php-src-8.4/Zend/zend_extensions.c:218
#11 0x58c67da7ffbe in php_module_startup /home/ilia/php-src-8.4/main/main.c:2292
#12 0x58c67e5ef83c in php_cli_startup /home/ilia/php-src-8.4/sapi/cli/php_cli.c:397
#13 0x58c67e5f5ebb in main /home/ilia/php-src-8.4/sapi/cli/php_cli.c:1289
#14 0x7d32b4429d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
SUMMARY: AddressSanitizer: heap-use-after-free /home/ilia/xdebug/src/lib/cmd_parser.c:115 in xdebug_cmd_parse
Shadow bytes around the buggy address:
0x0a227fff8290: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0a227fff82a0: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0a227fff82b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0a227fff82c0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
0x0a227fff82d0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0a227fff82e0: fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd
0x0a227fff82f0: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0a227fff8300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0a227fff8310: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
0x0a227fff8320: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0a227fff8330: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==278109==ABORTING
|
|---|
| Tags | No tags attached. |
|---|
|
| Operating System | |
|---|
| PHP Version | 8.4.10-8.4.19 |
|---|
|
