Skip to content

Commit 25a3663

Browse files
jvoisinjvoisin
committed
Make some parts of _zend_mm_heap read-only at runtime.
As [presented at OffensiveCon 2024](https://youtu.be/dqKFHjcK9hM?t=1622), having trivially callable writeable function pointers at the top of the heap makes it straightforward to turn a limited write into an arbitrary code execution. Disabling ZEND_MM_HEAP by default isn't doable, as it's used by a couple of profilers, so we're making some parts of `_zend_mm_heap` read-only at runtime instead: this will prevent the custom heap functions pointers from being hijacked, and we're also throwing the `shadow_key` there as it doesn't hurt to make it read-only as well.
1 parent 37488d6 commit 25a3663

File tree

2 files changed

+76
-39
lines changed

2 files changed

+76
-39
lines changed

‎Zend/zend_alloc.c

Lines changed: 75 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -217,6 +217,8 @@ typedef zend_mm_bitset zend_mm_page_map[ZEND_MM_PAGE_MAP_LEN]; /* 64B */
217217

218218
#define ZEND_MM_BINS 30
219219

220+
#define ZEND_MM_RO_HEAP(heap) ((zend_mm_ro_heap*)((char*)(heap) + REAL_PAGE_SIZE))
221+
220222
#if defined(_MSC_VER)
221223
# if UINTPTR_MAX == UINT64_MAX
222224
# define BSWAPPTR(u) _byteswap_uint64(u)
@@ -263,6 +265,23 @@ typedef struct _zend_mm_huge_list zend_mm_huge_list;
263265

264266
static bool zend_mm_use_huge_pages = false;
265267

268+
#define ZEND_MM_DEFAULT_PAGE_SIZE 4096
269+
270+
static size_t zend_mm_get_page_size(void)
271+
{
272+
static size_t page_size = 0;
273+
274+
if (!page_size) {
275+
page_size = zend_get_page_size();
276+
if (!page_size || (page_size & (page_size - 1))) {
277+
/* anyway, we have to return a valid result */
278+
page_size = ZEND_MM_DEFAULT_PAGE_SIZE;
279+
}
280+
}
281+
282+
return page_size;
283+
}
284+
266285
/*
267286
* Memory is retrieved from OS by chunks of fixed size 2MB.
268287
* Inside chunk it's managed by pages of fixed size 4096B.
@@ -306,7 +325,6 @@ struct _zend_mm_heap {
306325
size_t size; /* current memory usage */
307326
size_t peak; /* peak memory usage */
308327
#endif
309-
uintptr_t shadow_key; /* free slot shadow ptr xor key */
310328
zend_mm_free_slot *free_slot[ZEND_MM_BINS]; /* free lists for small sizes */
311329
#if ZEND_MM_STAT || ZEND_MM_LIMIT
312330
size_t real_size; /* current size of allocated pages */
@@ -329,16 +347,25 @@ struct _zend_mm_heap {
329347
double avg_chunks_count; /* average number of chunks allocated per request */
330348
int last_chunks_delete_boundary; /* number of chunks after last deletion */
331349
int last_chunks_delete_count; /* number of deletion over the last boundary */
350+
#if ZEND_MM_CUSTOM
351+
HashTable *tracked_allocs;
352+
#endif
353+
pid_t pid;
354+
zend_random_bytes_insecure_state rand_state;
355+
};
356+
357+
/* This contains security-sensitive data, and is thus mapped as read-only at run-time right after the _zend_mm_heap struct
358+
* and accessed via the ZEND_MM_RO_HEAP macro.*/
359+
struct _zend_mm_ro_heap {
360+
uintptr_t shadow_key; /* free slot shadow ptr xor key */
361+
332362
#if ZEND_MM_CUSTOM
333363
struct {
334364
void *(*_malloc)(size_t ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC);
335365
void (*_free)(void* ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC);
336366
void *(*_realloc)(void*, size_t ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC);
337367
} custom_heap;
338-
HashTable *tracked_allocs;
339368
#endif
340-
pid_t pid;
341-
zend_random_bytes_insecure_state rand_state;
342369
};
343370

344371
struct _zend_mm_chunk {
@@ -349,7 +376,6 @@ struct _zend_mm_chunk {
349376
uint32_t free_tail; /* number of free pages at the end of chunk */
350377
uint32_t num;
351378
char reserve[64 - (sizeof(void*) * 3 + sizeof(uint32_t) * 3)];
352-
zend_mm_heap heap_slot; /* used only in main chunk */
353379
zend_mm_page_map free_map; /* 512 bits or 64 bytes */
354380
zend_mm_page_info map[ZEND_MM_PAGES]; /* 2 KB = 512 * 4 */
355381
};
@@ -1331,18 +1357,18 @@ static zend_always_inline int zend_mm_small_size_to_bin(size_t size)
13311357
static zend_always_inline zend_mm_free_slot* zend_mm_encode_free_slot(const zend_mm_heap *heap, const zend_mm_free_slot *slot)
13321358
{
13331359
#ifdef WORDS_BIGENDIAN
1334-
return (zend_mm_free_slot*)(((uintptr_t)slot) ^ heap->shadow_key);
1360+
return (zend_mm_free_slot*)(((uintptr_t)slot) ^ ZEND_MM_RO_HEAP(heap)->shadow_key);
13351361
#else
1336-
return (zend_mm_free_slot*)(BSWAPPTR((uintptr_t)slot) ^ heap->shadow_key);
1362+
return (zend_mm_free_slot*)(BSWAPPTR((uintptr_t)slot) ^ ZEND_MM_RO_HEAP(heap)->shadow_key);
13371363
#endif
13381364
}
13391365

13401366
static zend_always_inline zend_mm_free_slot* zend_mm_decode_free_slot(zend_mm_heap *heap, zend_mm_free_slot *slot)
13411367
{
13421368
#ifdef WORDS_BIGENDIAN
1343-
return (zend_mm_free_slot*)((uintptr_t)slot ^ heap->shadow_key);
1369+
return (zend_mm_free_slot*)((uintptr_t)slot ^ ZEND_MM_RO_HEAP(heap)->shadow_key);
13441370
#else
1345-
return (zend_mm_free_slot*)(BSWAPPTR((uintptr_t)slot ^ heap->shadow_key));
1371+
return (zend_mm_free_slot*)(BSWAPPTR((uintptr_t)slot ^ ZEND_MM_RO_HEAP(heap)->shadow_key));
13461372
#endif
13471373
}
13481374

@@ -2045,7 +2071,9 @@ static void zend_mm_free_huge(zend_mm_heap *heap, void *ptr ZEND_FILE_LINE_DC ZE
20452071

20462072
static void zend_mm_refresh_key(zend_mm_heap *heap)
20472073
{
2048-
zend_random_bytes_insecure(&heap->rand_state, &heap->shadow_key, sizeof(heap->shadow_key));
2074+
mprotect(ZEND_MM_RO_HEAP(heap), zend_mm_get_page_size(), PROT_WRITE);
2075+
zend_random_bytes_insecure(&heap->rand_state, &(ZEND_MM_RO_HEAP(heap)->shadow_key), sizeof(ZEND_MM_RO_HEAP(heap)->shadow_key));
2076+
mprotect(ZEND_MM_RO_HEAP(heap), zend_mm_get_page_size(), PROT_READ);
20492077
}
20502078

20512079
static void zend_mm_init_key(zend_mm_heap *heap)
@@ -2056,16 +2084,15 @@ static void zend_mm_init_key(zend_mm_heap *heap)
20562084

20572085
static zend_mm_heap *zend_mm_init(void)
20582086
{
2087+
zend_mm_heap *heap = (zend_mm_heap*)zend_mm_chunk_alloc_int(zend_mm_get_page_size() * 2, zend_mm_get_page_size());
20592088
zend_mm_chunk *chunk = (zend_mm_chunk*)zend_mm_chunk_alloc_int(ZEND_MM_CHUNK_SIZE, ZEND_MM_CHUNK_SIZE);
2060-
zend_mm_heap *heap;
20612089

20622090
if (UNEXPECTED(chunk == NULL)) {
20632091
#if ZEND_MM_ERROR
20642092
fprintf(stderr, "Can't initialize heap\n");
20652093
#endif
20662094
return NULL;
20672095
}
2068-
heap = &chunk->heap_slot;
20692096
chunk->heap = heap;
20702097
chunk->next = chunk;
20712098
chunk->prev = chunk;
@@ -2103,6 +2130,9 @@ static zend_mm_heap *zend_mm_init(void)
21032130
#endif
21042131
heap->huge_list = NULL;
21052132
heap->pid = getpid();
2133+
2134+
mprotect(ZEND_MM_RO_HEAP(heap), zend_mm_get_page_size(), PROT_READ);
2135+
21062136
return heap;
21072137
}
21082138

@@ -2431,7 +2461,7 @@ void zend_mm_shutdown(zend_mm_heap *heap, bool full, bool silent)
24312461

24322462
#if ZEND_MM_CUSTOM
24332463
if (heap->use_custom_heap) {
2434-
if (heap->custom_heap._malloc == tracked_malloc) {
2464+
if (ZEND_MM_RO_HEAP(heap)->custom_heap._malloc == tracked_malloc) {
24352465
if (silent) {
24362466
tracked_free_all();
24372467
}
@@ -2440,13 +2470,15 @@ void zend_mm_shutdown(zend_mm_heap *heap, bool full, bool silent)
24402470
zend_hash_destroy(heap->tracked_allocs);
24412471
free(heap->tracked_allocs);
24422472
/* Make sure the heap free below does not use tracked_free(). */
2443-
heap->custom_heap._free = __zend_free;
2473+
mprotect(ZEND_MM_RO_HEAP(heap), zend_mm_get_page_size(), PROT_WRITE);
2474+
ZEND_MM_RO_HEAP(heap)->custom_heap._free = __zend_free;
2475+
mprotect(ZEND_MM_RO_HEAP(heap), zend_mm_get_page_size(), PROT_READ);
24442476
}
24452477
heap->size = 0;
24462478
}
24472479

24482480
if (full) {
2449-
heap->custom_heap._free(heap ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC);
2481+
ZEND_MM_RO_HEAP(heap)->custom_heap._free(heap ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC);
24502482
}
24512483
return;
24522484
}
@@ -2511,7 +2543,7 @@ void zend_mm_shutdown(zend_mm_heap *heap, bool full, bool silent)
25112543

25122544
/* reinitialize the first chunk and heap */
25132545
p = heap->main_chunk;
2514-
p->heap = &p->heap_slot;
2546+
//p->heap = &p->heap_slot;
25152547
p->next = p;
25162548
p->prev = p;
25172549
p->free_pages = ZEND_MM_PAGES - ZEND_MM_FIRST_PAGE;
@@ -2575,7 +2607,7 @@ ZEND_API size_t ZEND_FASTCALL _zend_mm_block_size(zend_mm_heap *heap, void *ptr
25752607
{
25762608
#if ZEND_MM_CUSTOM
25772609
if (UNEXPECTED(heap->use_custom_heap)) {
2578-
if (heap->custom_heap._malloc == tracked_malloc) {
2610+
if (ZEND_MM_RO_HEAP(heap)->custom_heap._malloc == tracked_malloc) {
25792611
zend_ulong h = ((uintptr_t) ptr) >> ZEND_MM_ALIGNMENT_LOG2;
25802612
zval *size_zv = zend_hash_index_find(heap->tracked_allocs, h);
25812613
if (size_zv) {
@@ -2618,7 +2650,7 @@ ZEND_API bool is_zend_ptr(const void *ptr)
26182650
{
26192651
#if ZEND_MM_CUSTOM
26202652
if (AG(mm_heap)->use_custom_heap) {
2621-
if (AG(mm_heap)->custom_heap._malloc == tracked_malloc) {
2653+
if (ZEND_MM_RO_HEAP(AG(mm_heap))->custom_heap._malloc == tracked_malloc) {
26222654
zend_ulong h = ((uintptr_t) ptr) >> ZEND_MM_ALIGNMENT_LOG2;
26232655
zval *size_zv = zend_hash_index_find(AG(mm_heap)->tracked_allocs, h);
26242656
if (size_zv) {
@@ -2661,12 +2693,12 @@ ZEND_API bool is_zend_ptr(const void *ptr)
26612693
#if ZEND_MM_CUSTOM
26622694
# define ZEND_MM_CUSTOM_ALLOCATOR(size) do { \
26632695
if (UNEXPECTED(AG(mm_heap)->use_custom_heap)) { \
2664-
return AG(mm_heap)->custom_heap._malloc(size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); \
2696+
return ZEND_MM_RO_HEAP(AG(mm_heap))->custom_heap._malloc(size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); \
26652697
} \
26662698
} while (0)
26672699
# define ZEND_MM_CUSTOM_DEALLOCATOR(ptr) do { \
26682700
if (UNEXPECTED(AG(mm_heap)->use_custom_heap)) { \
2669-
AG(mm_heap)->custom_heap._free(ptr ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); \
2701+
ZEND_MM_RO_HEAP(AG(mm_heap))->custom_heap._free(ptr ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); \
26702702
return; \
26712703
} \
26722704
} while (0)
@@ -2762,7 +2794,7 @@ ZEND_API void* ZEND_FASTCALL _emalloc(size_t size ZEND_FILE_LINE_DC ZEND_FILE_LI
27622794
{
27632795
#if ZEND_MM_CUSTOM
27642796
if (UNEXPECTED(AG(mm_heap)->use_custom_heap)) {
2765-
return AG(mm_heap)->custom_heap._malloc(size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); \
2797+
return ZEND_MM_RO_HEAP(AG(mm_heap))->custom_heap._malloc(size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); \
27662798
}
27672799
#endif
27682800
return zend_mm_alloc_heap(AG(mm_heap), size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
@@ -2772,7 +2804,7 @@ ZEND_API void ZEND_FASTCALL _efree(void *ptr ZEND_FILE_LINE_DC ZEND_FILE_LINE_OR
27722804
{
27732805
#if ZEND_MM_CUSTOM
27742806
if (UNEXPECTED(AG(mm_heap)->use_custom_heap)) {
2775-
AG(mm_heap)->custom_heap._free(ptr ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
2807+
ZEND_MM_RO_HEAP(AG(mm_heap))->custom_heap._free(ptr ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
27762808
return;
27772809
}
27782810
#endif
@@ -2783,7 +2815,7 @@ ZEND_API void* ZEND_FASTCALL _erealloc(void *ptr, size_t size ZEND_FILE_LINE_DC
27832815
{
27842816
#if ZEND_MM_CUSTOM
27852817
if (UNEXPECTED(AG(mm_heap)->use_custom_heap)) {
2786-
return AG(mm_heap)->custom_heap._realloc(ptr, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
2818+
return ZEND_MM_RO_HEAP(AG(mm_heap))->custom_heap._realloc(ptr, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
27872819
}
27882820
#endif
27892821
return zend_mm_realloc_heap(AG(mm_heap), ptr, size, 0, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
@@ -2793,7 +2825,7 @@ ZEND_API void* ZEND_FASTCALL _erealloc2(void *ptr, size_t size, size_t copy_size
27932825
{
27942826
#if ZEND_MM_CUSTOM
27952827
if (UNEXPECTED(AG(mm_heap)->use_custom_heap)) {
2796-
return AG(mm_heap)->custom_heap._realloc(ptr, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
2828+
return ZEND_MM_RO_HEAP(AG(mm_heap))->custom_heap._realloc(ptr, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
27972829
}
27982830
#endif
27992831
return zend_mm_realloc_heap(AG(mm_heap), ptr, size, 1, copy_size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
@@ -3057,25 +3089,28 @@ static void alloc_globals_ctor(zend_alloc_globals *alloc_globals)
30573089
tmp = getenv("USE_ZEND_ALLOC");
30583090
if (tmp && !ZEND_ATOL(tmp)) {
30593091
bool tracked = (tmp = getenv("USE_TRACKED_ALLOC")) && ZEND_ATOL(tmp);
3060-
zend_mm_heap *mm_heap = alloc_globals->mm_heap = malloc(sizeof(zend_mm_heap));
3092+
//TODO(jvoisin) fix this
3093+
zend_mm_heap *mm_heap = alloc_globals->mm_heap = malloc(zend_mm_get_page_size() * 2);
30613094
memset(mm_heap, 0, sizeof(zend_mm_heap));
30623095
mm_heap->use_custom_heap = ZEND_MM_CUSTOM_HEAP_STD;
30633096
mm_heap->limit = (size_t)Z_L(-1) >> 1;
30643097
mm_heap->overflow = 0;
30653098

3099+
mprotect(ZEND_MM_RO_HEAP(mm_heap), zend_mm_get_page_size(), PROT_WRITE);
30663100
if (!tracked) {
30673101
/* Use system allocator. */
3068-
mm_heap->custom_heap._malloc = __zend_malloc;
3069-
mm_heap->custom_heap._free = __zend_free;
3070-
mm_heap->custom_heap._realloc = __zend_realloc;
3102+
ZEND_MM_RO_HEAP(mm_heap)->custom_heap._malloc = __zend_malloc;
3103+
ZEND_MM_RO_HEAP(mm_heap)->custom_heap._free = __zend_free;
3104+
ZEND_MM_RO_HEAP(mm_heap)->custom_heap._realloc = __zend_realloc;
30713105
} else {
30723106
/* Use system allocator and track allocations for auto-free. */
3073-
mm_heap->custom_heap._malloc = tracked_malloc;
3074-
mm_heap->custom_heap._free = tracked_free;
3075-
mm_heap->custom_heap._realloc = tracked_realloc;
3107+
ZEND_MM_RO_HEAP(mm_heap)->custom_heap._malloc = tracked_malloc;
3108+
ZEND_MM_RO_HEAP(mm_heap)->custom_heap._free = tracked_free;
3109+
ZEND_MM_RO_HEAP(mm_heap)->custom_heap._realloc = tracked_realloc;
30763110
mm_heap->tracked_allocs = malloc(sizeof(HashTable));
30773111
zend_hash_init(mm_heap->tracked_allocs, 1024, NULL, NULL, 1);
30783112
}
3113+
mprotect(ZEND_MM_RO_HEAP(mm_heap), zend_mm_get_page_size(), PROT_READ);
30793114
return;
30803115
}
30813116
#endif
@@ -3145,9 +3180,11 @@ ZEND_API void zend_mm_set_custom_handlers(zend_mm_heap *heap,
31453180
_heap->use_custom_heap = ZEND_MM_CUSTOM_HEAP_NONE;
31463181
} else {
31473182
_heap->use_custom_heap = ZEND_MM_CUSTOM_HEAP_STD;
3148-
_heap->custom_heap._malloc = _malloc;
3149-
_heap->custom_heap._free = _free;
3150-
_heap->custom_heap._realloc = _realloc;
3183+
mprotect(ZEND_MM_RO_HEAP(_heap), zend_mm_get_page_size(), PROT_WRITE);
3184+
ZEND_MM_RO_HEAP(_heap)->custom_heap._malloc = _malloc;
3185+
ZEND_MM_RO_HEAP(_heap)->custom_heap._free = _free;
3186+
ZEND_MM_RO_HEAP(_heap)->custom_heap._realloc = _realloc;
3187+
mprotect(ZEND_MM_RO_HEAP(_heap), zend_mm_get_page_size(), PROT_READ);
31513188
}
31523189
#endif
31533190
}
@@ -3161,9 +3198,9 @@ ZEND_API void zend_mm_get_custom_handlers(zend_mm_heap *heap,
31613198
zend_mm_heap *_heap = (zend_mm_heap*)heap;
31623199

31633200
if (heap->use_custom_heap) {
3164-
*_malloc = _heap->custom_heap._malloc;
3165-
*_free = _heap->custom_heap._free;
3166-
*_realloc = _heap->custom_heap._realloc;
3201+
*_malloc = ZEND_MM_RO_HEAP(_heap)->custom_heap._malloc;
3202+
*_free = ZEND_MM_RO_HEAP(_heap)->custom_heap._free;
3203+
*_realloc = ZEND_MM_RO_HEAP(_heap)->custom_heap._realloc;
31673204
} else {
31683205
*_malloc = NULL;
31693206
*_free = NULL;
@@ -3195,7 +3232,7 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
31953232
#if ZEND_MM_STORAGE
31963233
zend_mm_storage tmp_storage, *storage;
31973234
zend_mm_chunk *chunk;
3198-
zend_mm_heap *heap;
3235+
zend_mm_heap *heap = (zend_mm_heap*)zend_mm_chunk_alloc_int(REAL_PAGE_SIZE * 2, REAL_PAGE_SIZE);
31993236

32003237
memcpy((zend_mm_handlers*)&tmp_storage.handlers, handlers, sizeof(zend_mm_handlers));
32013238
tmp_storage.data = data;
@@ -3206,7 +3243,6 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
32063243
#endif
32073244
return NULL;
32083245
}
3209-
heap = &chunk->heap_slot;
32103246
chunk->heap = heap;
32113247
chunk->next = chunk;
32123248
chunk->prev = chunk;

‎Zend/zend_alloc.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -242,6 +242,7 @@ ZEND_API void zend_memory_reset_peak_usage(void);
242242

243243
/* Heap functions */
244244
typedef struct _zend_mm_heap zend_mm_heap;
245+
typedef struct _zend_mm_ro_heap zend_mm_ro_heap;
245246

246247
ZEND_API zend_mm_heap *zend_mm_startup(void);
247248
ZEND_API void zend_mm_shutdown(zend_mm_heap *heap, bool full_shutdown, bool silent);

0 commit comments

Comments
 (0)