Описание
Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
The following PHP code triggers a segmentation fault due to a NULL pointer dereference:
The crash occurs due to a mismatch between Oniguruma and mbfl encoding support:
- Oniguruma (the regex library) supports
iso-8859-11(Thai encoding) - mbfl (mbstring's internal encoding library) does NOT support
iso-8859-11
When mb_regex_encoding('iso-8859-11') is called:
php_mb_regex_set_mbctype()validates the encoding against Oniguruma → succeedsmbfl_name2encoding('iso-8859-11')is called → returns NULLMBREX(current_mbctype_mbfl_encoding)is set to NULL
Later, when mb_ereg_search_init() calls php_mb_check_encoding():
php_mb_regex_get_mbctype_encoding()returns NULLphp_mb_check_encoding()dereferences theNULLpointer → SEGV
This vulnerability allows a denial of service (DoS). An attacker can reliably crash a PHP process when user-controlled input influences the encoding passed to mb_regex_encoding() and the application subsequently uses mbregex search APIs.
Enumeration of all Oniguruma-supported encodings vs mbfl support:
| Encoding / aliases | Oniguruma | mbfl | Status |
|---|---|---|---|
| iso-8859-1 … iso-8859-10 | ✓ | ✓ | Safe |
| iso-8859-11, ISO8859-11 | ✓ | ✗ | CRASH |
| iso-8859-13 … iso-8859-16 | ✓ | ✓ | Safe |
| EUC-JP aliases: UJIS | ✓ | ✗ | CRASH |
| EUC-CN aliases: GB-2312 | ✓ | ✗ | CRASH |
| KOI8 aliases: KOI-8R | ✓ | ✗ | CRASH |
| ASCII aliases: US_ASCII, ISO646 | ✓ | ✗ | CRASH |
| KOI8 (no suffix) | ✓ | ✗ | Safe (rejected by mb_regex_encoding()) |
| All other encodings | ✓ | ✓ | Safe |
Credits
Viet Hoang Luu - The University of Melbourne Amirmohammad Pasdar - The University of Melbourne Wachiraphan Charoenwet - The University of Melbourne Shaanan Cohney - The University of Melbourne Toby Murray - The University of Melbourne Van-Thuan Pham - The University of Melbourne
Пакеты
php
>=8.5.0, <8.5.6
8.5.6
php
>=8.4.0, <8.4.21
8.4.21
php
>=8.3.0, <8.3.31
8.3.31
php
>=8.2.0, <8.2.31
8.2.31
Связанные уязвимости
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().
Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before ...