Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Vulnerability I am referring to is:

And here in more detail:

So basically what it amounts to is that in the code someone forgot to add an "else" statement and it allows an attacker-controlled string to be interpreted as a ZVAL struct. What I want to know is if an attacker could potentially store something else other than a hardcoded address in the string he/she controlls such as a pointer or register. I'm pretty sure this isn't possible, but if it was it would make code execution much easier.

share|improve this question
up vote 1 down vote accepted

This is a nasty vulnerability. In short, it allows a remote attacker to read and/or write to an arbitrary memory address. So you can't modify a register directly. Being able to read an arbitrary memory address is very important in modern exploitation because it allows you to read an ASLR'ed memory address. This is important because when you control the EIP, you can then point it to the exact memory location of the attacker's shell code. This vulnerability also bypasses canaries, its not a buffer overflow, the attacker can overwrite the return address directly on the stack which will become the EIP when a target function returns.

share|improve this answer
Well I guess its not a traditional overflow but it is an overflow in that you can provide a greater number of variables than was intended that causes unintended behavior. – user1424104 Jun 8 '12 at 1:16
@user1424104 not really, it feels more like a dangling pointer than a buffer overflow to me. But its really neither, its abusing PHP's own strange behavior. This isn't the first ZVAL struct vulnerability found by Stefan Esser. – rook Jun 8 '12 at 1:18
Could you explain what you mean by "that excludes a pointer to a pointer"? Presumably this vulnerability does allow to overwrite an address that happens to store another pointer. Not sure if that's what you meant by "pointer to a pointer". – D.W. Jun 8 '12 at 16:55
@D.W. well it won't automatically resolve an address, yeah that was worded poorly. Sorry. Yeah you can overwrite an address no problem. – rook Jun 8 '12 at 17:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.