Skip to content

Commit 6c0e2eb

Browse files
bukkabukka
committed
Fix GHSA-h35g-vwh6-m678: Mysqlnd - various heap buffer over-reads
This fixes issues causing buffer over-read that leak heap content: - RESP packet field default left over for COM_LIST - RESP packet upsert filename - OK packet message - RESP packet for stmt row data - ps_fetch_from_1_to_8_bytes - ps_fetch_float - ps_fetch_double - ps_fetch_time - ps_fetch_date - ps_fetch_datetime - ps_fetch_string - ps_fetch_bit - RESP packet for query row data (just possible overflow on 32bit) It also adds various protocol tests using a new fake server.
1 parent 90c851a commit 6c0e2eb

18 files changed

+1792
-21
lines changed

‎ext/mysqli/tests/fake_server.inc

Lines changed: 856 additions & 0 deletions
Large diffs are not rendered by default.

‎ext/mysqli/tests/ghsa-h35g-vwh6-m678-auth-message.phpt

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
--TEST--
2+
GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - auth message buffer over-read)
3+
--EXTENSIONS--
4+
mysqli
5+
--FILE--
6+
<?php
7+
require_once 'fake_server.inc';
8+
9+
$port = 50001;
10+
$servername = "127.0.0.1";
11+
$username = "root";
12+
$password = "";
13+
14+
$process = run_fake_server_in_background('auth_response_message_over_read', $port);
15+
$process->wait();
16+
17+
try {
18+
$conn = new mysqli( $servername, $username, $password, "", $port );
19+
$info = mysqli_info($conn);
20+
var_dump($info);
21+
} catch (Exception $e) {
22+
echo $e->getMessage() . PHP_EOL;
23+
}
24+
25+
$process->terminate();
26+
27+
print "done!";
28+
?>
29+
--EXPECTF--
30+
[*] Server started
31+
[*] Connection established
32+
[*] Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
33+
[*] Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
34+
[*] Sending - Malicious OK Auth Response [Extract heap through buffer over-read]: 0900000200000002000000fcff
35+
36+
Warning: mysqli::__construct(): OK packet message length is past the packet size in %s on line %d
37+
Unknown error while trying to connect via tcp://127.0.0.1:50001
38+
done!

‎ext/mysqli/tests/ghsa-h35g-vwh6-m678-def.phpt

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
--TEST--
2+
GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - tabular default)
3+
--EXTENSIONS--
4+
mysqli
5+
--FILE--
6+
<?php
7+
require_once 'fake_server.inc';
8+
9+
10+
$port = 33305;
11+
$servername = "127.0.0.1";
12+
$username = "root";
13+
$password = "";
14+
15+
$process = run_fake_server_in_background('tabular_response_def_over_read', $port);
16+
$process->wait();
17+
18+
$conn = new mysqli($servername, $username, $password, "", $port);
19+
20+
echo "[*] Running query on the fake server...\n";
21+
22+
$result = $conn->query("SELECT * from users");
23+
24+
if ($result) {
25+
$all_fields = $result->fetch_fields();
26+
var_dump($result->fetch_all(MYSQLI_ASSOC));
27+
var_dump(get_object_vars($all_fields[0])["def"]);
28+
}
29+
30+
$conn->close();
31+
32+
$process->terminate();
33+
34+
print "done!";
35+
?>
36+
--EXPECTF--
37+
[*] Server started
38+
[*] Connection established
39+
[*] Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
40+
[*] Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
41+
[*] Sending - Server OK: 0700000200000002000000
42+
[*] Running query on the fake server...
43+
[*] Received: 140000000353454c454354202a2066726f6d207573657273
44+
[*] Sending - Malicious Tabular Response [Extract heap through buffer over-read]: 01000001011e0000020164016401640164016401640c3f000b000000030350000000fd000001aa05000003fe00002200040000040135017405000005fe00002200
45+
46+
Warning: mysqli::query(): Protocol error. Server sent default for unsupported field list (mysqlnd_wireprotocol.c:%d) in %s on line %d
47+
done!

‎ext/mysqli/tests/ghsa-h35g-vwh6-m678-filename.phpt

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
--TEST--
2+
GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - upsert filename buffer over-read)
3+
--EXTENSIONS--
4+
mysqli
5+
--FILE--
6+
<?php
7+
require_once 'fake_server.inc';
8+
9+
$port = 33305;
10+
$servername = "127.0.0.1";
11+
$username = "root";
12+
$password = "";
13+
14+
$process = run_fake_server_in_background('upsert_response_filename_over_read', $port);
15+
$process->wait();
16+
17+
$conn = new mysqli($servername, $username, $password, "", $port);
18+
echo "[*] Running query on the fake server...\n";
19+
20+
$result = $conn->query("SELECT * from users");
21+
$info = mysqli_info($conn);
22+
23+
var_dump($info);
24+
25+
$process->terminate();
26+
27+
print "done!";
28+
?>
29+
--EXPECTF--
30+
[*] Server started
31+
[*] Connection established
32+
[*] Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
33+
[*] Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
34+
[*] Sending - Server OK: 0700000200000002000000
35+
[*] Running query on the fake server...
36+
[*] Received: 140000000353454c454354202a2066726f6d207573657273
37+
[*] Sending - Malicious Tabular Response [Extract heap through buffer over-read]: 0900000100000000000000fa65
38+
39+
Warning: mysqli::query(): RSET_HEADER packet additional data length is past 249 bytes the packet size in %s on line %d
40+
41+
Warning: mysqli::query(): Error reading result set's header in %s on line %d
42+
NULL
43+
done!

‎ext/mysqli/tests/ghsa-h35g-vwh6-m678-query-len-overflow.phpt

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
--TEST--
2+
GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - stmt row no space for the field)
3+
--EXTENSIONS--
4+
mysqli
5+
--FILE--
6+
<?php
7+
require_once 'fake_server.inc';
8+
9+
$port = 33305;
10+
$servername = "127.0.0.1";
11+
$username = "root";
12+
$password = "";
13+
14+
$process = run_fake_server_in_background('query_response_row_length_overflow', $port);
15+
$process->wait();
16+
17+
$conn = new mysqli($servername, $username, $password, "", $port);
18+
19+
echo "[*] Query the fake server...\n";
20+
$sql = "SELECT strval, strval FROM data";
21+
22+
$result = $conn->query($sql);
23+
24+
if ($result->num_rows > 0) {
25+
while ($row = $result->fetch_assoc()) {
26+
var_dump($row['strval']);
27+
}
28+
}
29+
$conn->close();
30+
31+
$process->terminate(true);
32+
33+
print "done!";
34+
?>
35+
--EXPECTF--
36+
[*] Server started
37+
[*] Connection established
38+
[*] Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
39+
[*] Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
40+
[*] Sending - Server OK: 0700000200000002000000
41+
[*] Query the fake server...
42+
[*] Received: 200000000353454c4543542073747276616c2c2073747276616c2046524f4d2064617461
43+
[*] Sending - Malicious Query Response for data strval field [length overflow]: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd011000000005000004fe000022000a0000050474657374fefefefefe05000006fe00002200
44+
45+
Warning: mysqli_result::fetch_assoc(): Malformed server packet. Field length pointing after end of packet in %s on line %d
46+
[*] Received: 0100000001
47+
[*] Server finished
48+
done!

‎ext/mysqli/tests/ghsa-h35g-vwh6-m678-stmt-row-bit.phpt

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
--TEST--
2+
GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - stmt row bit buffer over-read)
3+
--EXTENSIONS--
4+
mysqli
5+
--FILE--
6+
<?php
7+
require_once 'fake_server.inc';
8+
9+
$port = 33305;
10+
$servername = "127.0.0.1";
11+
$username = "root";
12+
$password = "";
13+
14+
$process = run_fake_server_in_background('stmt_response_row_over_read_bit', $port);
15+
$process->wait();
16+
17+
$conn = new mysqli($servername, $username, $password, "", $port);
18+
19+
echo "[*] Preparing statement on the fake server...\n";
20+
$stmt = $conn->prepare("SELECT bitval, timval FROM data");
21+
22+
$stmt->execute();
23+
$result = $stmt->get_result();
24+
25+
// Fetch and display the results
26+
if ($result->num_rows > 0) {
27+
while ($row = $result->fetch_assoc()) {
28+
var_dump($row["bitval"]);
29+
}
30+
}
31+
$stmt->close();
32+
$conn->close();
33+
34+
$process->terminate(true);
35+
36+
print "done!";
37+
?>
38+
--EXPECTF--
39+
[*] Server started
40+
[*] Connection established
41+
[*] Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
42+
[*] Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
43+
[*] Sending - Server OK: 0700000200000002000000
44+
[*] Preparing statement on the fake server...
45+
[*] Received: 200000001653454c4543542062697476616c2c2074696d76616c2046524f4d2064617461
46+
[*] Sending - Stmt prepare data bitval: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610662697476616c0662697476616c0c3f004000000010211000000005000004fe00000200
47+
[*] Received: 0a00000017010000000001000000
48+
[*] Sending - Malicious Stmt Response for data bitval [Extract heap through buffer over-read]: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610662697476616c0662697476616c0c3f004000000010211000000005000004fe00002200100000050000067465737408080808080808080805000006fe00002200
49+
50+
Warning: mysqli_result::fetch_assoc(): Malformed server packet. Field length pointing after the end of packet in %s on line %d
51+
[*] Received: 0500000019010000000100000001
52+
[*] Server finished
53+
done!

‎ext/mysqli/tests/ghsa-h35g-vwh6-m678-stmt-row-date.phpt

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
--TEST--
2+
GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - stmt row date buffer over-read)
3+
--EXTENSIONS--
4+
mysqli
5+
--FILE--
6+
<?php
7+
require_once 'fake_server.inc';
8+
9+
$port = 33305;
10+
$servername = "127.0.0.1";
11+
$username = "root";
12+
$password = "";
13+
14+
$process = run_fake_server_in_background('stmt_response_row_over_read_date', $port);
15+
$process->wait();
16+
17+
$conn = new mysqli($servername, $username, $password, "", $port);
18+
19+
echo "[*] Preparing statement on the fake server...\n";
20+
$stmt = $conn->prepare("SELECT strval, datval FROM data");
21+
22+
$stmt->execute();
23+
$result = $stmt->get_result();
24+
25+
// Fetch and display the results
26+
if ($result->num_rows > 0) {
27+
while ($row = $result->fetch_assoc()) {
28+
var_dump($row["datval"]);
29+
}
30+
}
31+
$stmt->close();
32+
$conn->close();
33+
34+
$process->terminate(true);
35+
36+
print "done!";
37+
?>
38+
--EXPECTF--
39+
[*] Server started
40+
[*] Connection established
41+
[*] Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
42+
[*] Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
43+
[*] Sending - Server OK: 0700000200000002000000
44+
[*] Preparing statement on the fake server...
45+
[*] Received: 200000001653454c4543542073747276616c2c2064617476616c2046524f4d2064617461
46+
[*] Sending - Stmt prepare data datval: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664617476616c0664617476616c0c3f000a0000000a811000000005000004fe00000200
47+
[*] Received: 0a00000017010000000001000000
48+
[*] Sending - Malicious Stmt Response for data datval [Extract heap through buffer over-read]: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664617476616c0664617476616c0c3f000a0000000a811000000005000004fe000022000c0000050000067465737404de070c0f05000006fe00002200
49+
50+
Warning: mysqli_result::fetch_assoc(): Malformed server packet. Field length pointing after the end of packet in %s on line %d
51+
[*] Received: 0500000019010000000100000001
52+
[*] Server finished
53+
done!

‎ext/mysqli/tests/ghsa-h35g-vwh6-m678-stmt-row-datetime.phpt

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
--TEST--
2+
GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - stmt row datetime buffer over-read)
3+
--EXTENSIONS--
4+
mysqli
5+
--FILE--
6+
<?php
7+
require_once 'fake_server.inc';
8+
9+
$port = 33305;
10+
$servername = "127.0.0.1";
11+
$username = "root";
12+
$password = "";
13+
14+
$process = run_fake_server_in_background('stmt_response_row_over_read_datetime', $port);
15+
$process->wait();
16+
17+
$conn = new mysqli($servername, $username, $password, "", $port);
18+
19+
echo "[*] Preparing statement on the fake server...\n";
20+
$stmt = $conn->prepare("SELECT strval, dtival FROM data");
21+
22+
$stmt->execute();
23+
$result = $stmt->get_result();
24+
25+
// Fetch and display the results
26+
if ($result->num_rows > 0) {
27+
while ($row = $result->fetch_assoc()) {
28+
var_dump($row["dtival"]);
29+
}
30+
}
31+
$stmt->close();
32+
$conn->close();
33+
34+
$process->terminate(true);
35+
36+
print "done!";
37+
?>
38+
--EXPECTF--
39+
[*] Server started
40+
[*] Connection established
41+
[*] Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
42+
[*] Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
43+
[*] Sending - Server OK: 0700000200000002000000
44+
[*] Preparing statement on the fake server...
45+
[*] Received: 200000001653454c4543542073747276616c2c2064746976616c2046524f4d2064617461
46+
[*] Sending - Stmt prepare data dtival: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664746976616c0664746976616c0c3f00130000000c811000000005000004fe00000200
47+
[*] Received: 0a00000017010000000001000000
48+
[*] Sending - Malicious Stmt Response for data dtival [Extract heap through buffer over-read]: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664746976616c0664746976616c0c3f00130000000c811000000005000004fe000022000f0000050000067465737407de070c100d000105000006fe00002200
49+
50+
Warning: mysqli_result::fetch_assoc(): Malformed server packet. Field length pointing after the end of packet in %s on line %d
51+
[*] Received: 0500000019010000000100000001
52+
[*] Server finished
53+
done!

‎ext/mysqli/tests/ghsa-h35g-vwh6-m678-stmt-row-double.phpt

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
--TEST--
2+
GHSA-h35g-vwh6-m678 (mysqlnd leaks partial content of the heap - stmt row double buffer over-read)
3+
--EXTENSIONS--
4+
mysqli
5+
--FILE--
6+
<?php
7+
require_once 'fake_server.inc';
8+
9+
$port = 33305;
10+
$servername = "127.0.0.1";
11+
$username = "root";
12+
$password = "";
13+
14+
$process = run_fake_server_in_background('stmt_response_row_over_read_double', $port);
15+
$process->wait();
16+
17+
$conn = new mysqli($servername, $username, $password, "", $port);
18+
19+
echo "[*] Preparing statement on the fake server...\n";
20+
$stmt = $conn->prepare("SELECT strval, dblval FROM data");
21+
22+
$stmt->execute();
23+
$result = $stmt->get_result();
24+
25+
// Fetch and display the results
26+
if ($result->num_rows > 0) {
27+
while ($row = $result->fetch_assoc()) {
28+
var_dump($row["dblval"]);
29+
}
30+
}
31+
$stmt->close();
32+
$conn->close();
33+
34+
$process->terminate(true);
35+
36+
print "done!";
37+
?>
38+
--EXPECTF--
39+
[*] Server started
40+
[*] Connection established
41+
[*] Sending - Server Greeting: 580000000a352e352e352d31302e352e31382d4d6172696144420003000000473e3f6047257c6700fef7080200ff81150000000000000f0000006c6b55463f49335f686c6431006d7973716c5f6e61746976655f70617373776f7264
42+
[*] Received: 6900000185a21a00000000c0080000000000000000000000000000000000000000000000726f6f7400006d7973716c5f6e61746976655f70617373776f7264002c0c5f636c69656e745f6e616d65076d7973716c6e640c5f7365727665725f686f7374093132372e302e302e31
43+
[*] Sending - Server OK: 0700000200000002000000
44+
[*] Preparing statement on the fake server...
45+
[*] Received: 200000001653454c4543542073747276616c2c2064626c76616c2046524f4d2064617461
46+
[*] Sending - Stmt prepare data dblval: 0c0000010001000000020000000000003200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664626c76616c0664626c76616c0c3f00160000000501101f000005000004fe00000200
47+
[*] Received: 0a00000017010000000001000000
48+
[*] Sending - Malicious Stmt Response for data dblval [Extract heap through buffer over-read]: 01000001023200000203646566087068705f74657374046461746104646174610673747276616c0673747276616c0ce000c8000000fd01100000003200000303646566087068705f74657374046461746104646174610664626c76616c0664626c76616c0c3f00160000000501101f000005000004fe000022000f00000500000674657374333333333333f33f05000006fe00002200
49+
50+
Warning: mysqli_result::fetch_assoc(): Malformed server packet. Field length pointing after the end of packet in %s on line %d
51+
[*] Received: 0500000019010000000100000001
52+
[*] Server finished
53+
done!

0 commit comments

Comments
 (0)