Received-SPF: pass (google.com: domain of oss-security-return-30165-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) client-ip=193.110.157.125;
Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm
Precedence: bulk
Reply-To: oss-security@lists.openwall.com
From: Florian Weimer <fweimer@redhat.com>
To: Charles Fol <c.fol@lexfo.fr>
Cc: oss-security@lists.openwall.com
In-Reply-To: <7789a6d5-92c9-4239-8a07-7b0131ed166b@lexfo.fr> (Charles Fol's
	message of "Mon, 27 May 2024 11:16:53 +0200")
References: <23c15272-d797-4c3c-bbfb-e462c900978f@gmail.com>
	<20240418164242.GA2468@openwall.com>
	<7789a6d5-92c9-4239-8a07-7b0131ed166b@lexfo.fr>
Date: Mon, 27 May 2024 12:31:46 +0200
Message-ID: <87bk4r1r71.fsf@oldenburg.str.redhat.com>
User-Agent: Gnus/5.13 (Gnus v5.13)
MIME-Version: 1.0
Content-Type: text/plain
Subject: Re: [oss-security] The GNU C Library security advisories update for
 2024-04-17: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix
 out-of-bound writes when writing escape sequence

* Charles Fol:

> Hello all,
>
> Although very late, here is a follow up explaining the impact of the
> vulnerability.
>
> Provided that you can force an application to convert a partially
> controlled buffer to ISO-2022-CN-EXT, you get an
> overflow of 1 to 3 bytes whose value you don't control.
>
> This can be triggered in at least two ways in PHP:
>
> - Through direct calls to iconv()
> - Through the use of PHP filters (i.e. using a "file read" vulnerability)
>
> Due to the way PHP's heap is built, you can use such a memory
> corruption to alter part of a free list pointer,
> which can in turn give you an arbitrary write primitive in the
> program's memory.
>
> With this bug, any person that has a file read vulnerability with a
> controlled prefix on a PHP application has RCE.

Out of curiosity, why would PHP translate a file to ISO-2022-CN-EXT
while reading it?  It's not even an ASCII-transparent charset.

Thanks,
Florian