CVE-2016-1000005 (published 2020-02-19T13:15Z)

mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive).

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-843
cwe_name: Access of Resource Using Incompatible Type ('Type Confusion')
description: The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
extended_description: 
            When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties. In languages without memory safety, such as C and C++, type confusion can lead to out-of-bounds memory access.
            While this weakness is frequently associated with unions when parsing data with many different embedded object types in C, it can be present in any application that can interpret the same variable or memory location in multiple ways.
            This weakness is not unique to C and C++. For example, errors in PHP applications can be triggered by providing array parameters when scalars are expected, or vice versa. Languages such as Perl, which perform automatic conversion of a variable of one type when it is accessed as if it were another type, can also contain these issues.
         
         

Fix information:
repo_url: https://github.com/facebook/hhvm
commit_details: repo_url: https://github.com/facebook/hhvm
author: Max Wang
author_date: 2016-07-01 09:08:51-07:00
msg: Fix param types for mcrypt_get_block_size() to match PHP

Reviewed By: edwinsmith

Differential Revision: D3447281

fbshipit-source-id: a88549307faad886f5a0f78d421aa28e08d21b1c
repository: repo_url: https://github.com/facebook/hhvm
repo_name: facebook/hhvm
description: A virtual machine for executing programs written in Hack.
repo_language: Hack
owner: facebook
file_changes: filename: ext_mcrypt.cpp
change_type: ModificationType.MODIFY
diff: @@ -457,10 +457,10 @@ Variant HHVM_FUNCTION(mcrypt_ofb, const String& cipher, const String& key,
 }
 
 Variant HHVM_FUNCTION(mcrypt_get_block_size, const String& cipher,
-                                    const Variant& module /* = null_string */) {
+                                             const String& mode) {
   MCRYPT td = mcrypt_module_open((char*)cipher.data(),
                                  (char*)MCG(algorithms_dir).data(),
-                                 (char*)module.asCStrRef().data(),
+                                 (char*)mode.data(),
                                  (char*)MCG(modes_dir).data());
   if (td == MCRYPT_FAILED) {
     MCRYPT_OPEN_MODULE_FAILED("mcrypt_get_block_size");

programming_language: C++
filename: ext_mcrypt.php
change_type: ModificationType.MODIFY
diff: @@ -297,7 +297,7 @@ function mcrypt_generic(resource $td,
  */
 <<__Native>>
 function mcrypt_get_block_size(string $cipher,
-                               ?string $mode = null): mixed;
+                               string $mode): mixed;
 
 /**
  * Gets the name of the specified cipher

programming_language: PHP
filename: ext_mcrypt.php
change_type: ModificationType.MODIFY
diff: @@ -106,6 +106,7 @@ VS($decrypted, $CC);
 //////////////////////////////////////////////////////////////////////
 
 VS(mcrypt_get_block_size("tripledes", "ecb"), 8);
+mcrypt_get_block_size("tripledes");
 VS(mcrypt_get_cipher_name(MCRYPT_TRIPLEDES), "3DES");
 VS(mcrypt_get_iv_size(MCRYPT_CAST_256, MCRYPT_MODE_CFB), 16);
 VS(mcrypt_get_iv_size("des", "ecb"), 8);

programming_language: Rust
filename: ext_mcrypt.php.expectf
change_type: ModificationType.MODIFY
diff: @@ -38,6 +38,8 @@ Deprecated: Function mcrypt_ofb() is deprecated in %s/test/slow/ext_mcrypt/ext_m
 bool(true)
 bool(true)
 bool(true)
+
+Warning: mcrypt_get_block_size() expects exactly 2 parameters, 1 given in %s/test/slow/ext_mcrypt/ext_mcrypt.php on line 109
 bool(true)
 bool(true)
 bool(true)

programming_language: Lua