28 lines
942 B
YAML
28 lines
942 B
YAML
cve: CVE-2019-11043
|
|
alias: PHP-FPM env_path_info underflow
|
|
cwe_primary: CWE-787
|
|
cwe_acceptable: [CWE-787, CWE-191, CWE-119, CWE-124, CWE-125]
|
|
target_file: source.c
|
|
vuln_lines: [21, 28, 29, 33]
|
|
severity: critical
|
|
vuln_class: out_of_bounds_write
|
|
exploit_pattern_regex: '%0a|negative.*offset|underflow|path_info'
|
|
must_mention_any:
|
|
- negative
|
|
- bounds check
|
|
- underflow
|
|
- path_info
|
|
- script_name
|
|
- out-of-bounds write
|
|
- pointer arithmetic
|
|
points: 30
|
|
notes: |
|
|
Vulnerability: path_info_offset is computed as pointer difference and may
|
|
go negative when attacker engineers path_info < script_name (via specific
|
|
URL encodings). The subsequent `script_name[path_info_offset] = '\\0'`
|
|
writes outside the buffer with attacker-influenced index.
|
|
Hunter MUST identify:
|
|
1. The pointer arithmetic that produces path_info_offset.
|
|
2. The missing bounds check / sign check.
|
|
3. The out-of-bounds write at the indexed location.
|