Skip to content

ext/openssl: fix use after free when callbacks close streams #24065

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DanielEScherzer merged 6 commits into from
Nov 11, 2026
Merged

ext/openssl: fix use after free when callbacks close streams #24065

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
e60f0c2
ext/openssl: fix use after free when `early_data_cb` callback closes …
DanielEScherzer Oct 2, 2026
8309d9f
ext/openssl: fix use after free when `psk_client_cb` callback closes …
DanielEScherzer Oct 2, 2026
97ce0bf
ext/openssl: fix use after free when `psk_server_cb` callback closes …
DanielEScherzer Oct 2, 2026
010d6e2
ext/openssl: fix use after free when `session_get_cb` callback closes…
DanielEScherzer Oct 2, 2026
34c2d28
ext/openssl: fix use after free when `session_new_cb` callback closes…
DanielEScherzer Oct 2, 2026
0dbc4a7
Update NEWS for use-after-free fixes in ext/openssl
DanielEScherzer Nov 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions NEWS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,9 @@ PHP NEWS
structures with persistent streams). (cxxz16, David Carlier)
. Fixed an exception thrown by the session_get_cb stream context callback
being replaced with a TypeError. (Ilia Alshanetsky)
. Fixed use-after-free when a stream is closed by the callback for
`early_data_cb`, `psk_client_cb`, `psk_server_cb`, `session_get_cb`, or
`session_new_cb`. (DanielEScherzer)

- PDO_Firebird:
. Fixed stack buffer overflow with long connection user names, passwords,
Expand Down
93 changes: 93 additions & 0 deletions ext/openssl/tests/close_in_early_data_cb_UAF.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,93 @@
--TEST--
Closing the stream in the `early_data_cb` callback triggers use after free
--EXTENSIONS--
openssl
--CREDITS--
Calif.io
--CLEAN--
<?php

$certFile = sys_get_temp_dir() . '/php-audit-early-data-' . getmypid() . '.pem';
@unlink($certFile);
?>
--FILE--
<?php

$certFile = sys_get_temp_dir() . '/php-audit-early-data-' . getmypid() . '.pem';

$serverCode = <<<'PHP'
$context = stream_context_create(['ssl' => [
'local_cert' => '%s',
'session_id_context' => 'audit-early-data',
'max_early_data' => 16384,
'early_data_cb' => function ($stream, string $data): void {
fclose($stream);
},
]]);

$server = stream_socket_server(
'tls://127.0.0.1:0',
$errno,
$errstr,
STREAM_SERVER_BIND | STREAM_SERVER_LISTEN,
$context,
);
phpt_notify_server_start($server);

for ($connection = 0; $connection < 2; $connection++) {
$client = @stream_socket_accept($server, 10);
if ($client) {
fwrite($client, "response\n");
fclose($client);
}
}
PHP;
$serverCode = sprintf($serverCode, $certFile);

$clientCode = <<<'PHP'
$session = null;
$context = stream_context_create(['ssl' => [
'verify_peer' => false,
'verify_peer_name' => false,
'session_new_cb' => function ($stream, $newSession) use (&$session): void {
$session = $newSession;
},
]]);

$first = stream_socket_client(
'tls://{{ ADDR }}',
$errno,
$errstr,
10,
STREAM_CLIENT_CONNECT,
$context,
);
fgets($first);
fclose($first);

$earlyDataContext = stream_context_create(['ssl' => [
'verify_peer' => false,
'verify_peer_name' => false,
'session_data' => $session,
'early_data' => 'attacker-controlled-early-data',
]]);

@stream_socket_client(
'tls://{{ ADDR }}',
$errno,
$errstr,
10,
STREAM_CLIENT_CONNECT,
$earlyDataContext,
);
PHP;

require 'CertificateGenerator.inc';
$certificateGenerator = new CertificateGenerator();
$certificateGenerator->saveNewCertAsFileWithKey('audit_early_data', $certFile);

require 'ServerClientTestCase.inc';
ServerClientTestCase::getInstance()->run($clientCode, $serverCode);

?>
--EXPECT--
61 changes: 61 additions & 0 deletions ext/openssl/tests/close_in_psk_client_cb_UAF.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,61 @@
--TEST--
Closing the stream in the `psk_client_cb` callback triggers use after free
--EXTENSIONS--
openssl
--CREDITS--
Calif.io
--FILE--
<?php

$serverCode = <<<'PHP'
$context = stream_context_create(['ssl' => [
'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_SERVER,
'ciphers' => 'PSK',
'psk_server_cb' => static function ($stream, string $identity): ?Openssl\Psk {
if ($identity !== 'audit-client') {
return null;
}

return new Openssl\Psk(str_repeat("\x41", 32));
},
]]);

$server = stream_socket_server(
'tls://127.0.0.1:0',
$errno,
$errstr,
STREAM_SERVER_BIND | STREAM_SERVER_LISTEN,
$context,
);
phpt_notify_server_start($server);
@stream_socket_accept($server, 10);
PHP;

$clientCode = <<<'PHP'
$context = stream_context_create(['ssl' => [
'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT,
'ciphers' => 'PSK',
'verify_peer' => false,
'verify_peer_name' => false,
'psk_client_cb' => static function ($stream): ?Openssl\Psk {
fclose($stream);

return new Openssl\Psk(str_repeat("\x41", 32), 'audit-client');
},
]]);

@stream_socket_client(
'tls://{{ ADDR }}',
$errno,
$errstr,
10,
STREAM_CLIENT_CONNECT,
$context,
);
PHP;

require 'ServerClientTestCase.inc';
ServerClientTestCase::getInstance()->run($clientCode, $serverCode);

?>
--EXPECT--
55 changes: 55 additions & 0 deletions ext/openssl/tests/close_in_psk_server_cb_UAF.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
--TEST--
Closing the stream in the `psk_server_cb` callback triggers use after free
--EXTENSIONS--
openssl
--CREDITS--
Calif.io
--FILE--
<?php

$serverCode = <<<'PHP'
$context = stream_context_create(['ssl' => [
'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_3_SERVER,
'psk_server_cb' => function ($stream, string $identity): ?Openssl\Psk {
fclose($stream);
return null;
},
]]);

$server = stream_socket_server(
'tls://127.0.0.1:0',
$errno,
$errstr,
STREAM_SERVER_BIND | STREAM_SERVER_LISTEN,
$context,
);
phpt_notify_server_start($server);
@stream_socket_accept($server, 10);
PHP;

$clientCode = <<<'PHP'
$context = stream_context_create(['ssl' => [
'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_3_CLIENT,
'verify_peer' => false,
'verify_peer_name' => false,
'psk_client_cb' => fn ($stream) => new Openssl\Psk(
str_repeat("\x42", 32),
'remote-identity',
),
]]);

@stream_socket_client(
'tls://{{ ADDR }}',
$errno,
$errstr,
10,
STREAM_CLIENT_CONNECT,
$context,
);
PHP;

require 'ServerClientTestCase.inc';
ServerClientTestCase::getInstance()->run($clientCode, $serverCode);

?>
--EXPECT--
103 changes: 103 additions & 0 deletions ext/openssl/tests/close_in_session_get_cb_UAF.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,103 @@
--TEST--
Closing the stream in the `session_get_cb` callback triggers use after free
--EXTENSIONS--
openssl
--CREDITS--
Calif.io
--CLEAN--
<?php

$certFile = sys_get_temp_dir() . '/php-audit-session-get-' . getmypid() . '.pem';
@unlink($certFile);
?>
--FILE--
<?php

$certFile = sys_get_temp_dir() . '/php-audit-session-get-' . getmypid() . '.pem';

$serverCode = <<<'PHP'
$sessions = [];
$context = stream_context_create(['ssl' => [
'local_cert' => '%s',
'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_SERVER,
'session_id_context' => 'audit-session-get',
'session_new_cb' => static function ($stream, $session) use (&$sessions): void {
$sessions[bin2hex($session->id)] = $session;
},
'session_get_cb' => static function ($stream, string $sessionId) use (&$sessions) {
$session = $sessions[bin2hex($sessionId)] ?? null;
fclose($stream);

return $session;
},
]]);

$server = stream_socket_server(
'tls://127.0.0.1:0',
$errno,
$errstr,
STREAM_SERVER_BIND | STREAM_SERVER_LISTEN,
$context,
);
phpt_notify_server_start($server);

for ($i = 0; $i < 2; $i++) {
$client = @stream_socket_accept($server, 10);
if ($client) {
fwrite($client, "response\n");
fclose($client);
}
}
PHP;
$serverCode = sprintf($serverCode, $certFile);

$clientCode = <<<'PHP'
$session = null;
$context = stream_context_create(['ssl' => [
'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT,
'verify_peer' => false,
'verify_peer_name' => false,
'session_new_cb' => static function ($stream, $newSession) use (&$session): void {
$session = $newSession;
},
]]);

$first = stream_socket_client(
'tls://{{ ADDR }}',
$errno,
$errstr,
10,
STREAM_CLIENT_CONNECT,
$context,
);
if ($first) {
@fgets($first);
fclose($first);
}

$resumeContext = stream_context_create(['ssl' => [
'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT,
'verify_peer' => false,
'verify_peer_name' => false,
'session_data' => $session,
]]);

@stream_socket_client(
'tls://{{ ADDR }}',
$errno,
$errstr,
10,
STREAM_CLIENT_CONNECT,
$resumeContext,
);
PHP;

require 'CertificateGenerator.inc';
$certificateGenerator = new CertificateGenerator();
$certificateGenerator->saveNewCertAsFileWithKey('audit_session_get', $certFile);

require 'ServerClientTestCase.inc';
ServerClientTestCase::getInstance()->run($clientCode, $serverCode);

?>
--EXPECT--
71 changes: 71 additions & 0 deletions ext/openssl/tests/close_in_session_new_cb_UAF.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,71 @@
--TEST--
Closing the stream in the `session_new_cb` callback triggers use after free
--EXTENSIONS--
openssl
--CREDITS--
Calif.io
--CLEAN--
<?php

$certFile = sys_get_temp_dir() . '/php-audit-session-' . getmypid() . '.pem';
@unlink($certFile);
?>
--FILE--
<?php

$certFile = sys_get_temp_dir() . '/php-audit-session-' . getmypid() . '.pem';

$serverCode = <<<'PHP'
$context = stream_context_create(['ssl' => [
'local_cert' => '%s',
'session_cache' => true,
'session_id_context' => 'audit-session',
]]);

$server = stream_socket_server(
'tls://127.0.0.1:0',
$errno,
$errstr,
STREAM_SERVER_BIND | STREAM_SERVER_LISTEN,
$context,
);
phpt_notify_server_start($server);
$client = @stream_socket_accept($server, 10);
if ($client) {
fwrite($client, "ticket\n");
fclose($client);
}
PHP;
$serverCode = sprintf($serverCode, $certFile);

$clientCode = <<<'PHP'
$context = stream_context_create(['ssl' => [
'verify_peer' => false,
'verify_peer_name' => false,
'session_new_cb' => function ($stream, $session): void {
fclose($stream);
},
]]);

$client = @stream_socket_client(
'tls://{{ ADDR }}',
$errno,
$errstr,
10,
STREAM_CLIENT_CONNECT,
$context,
);
if ($client) {
@fgets($client);
}
PHP;

require 'CertificateGenerator.inc';
$certificateGenerator = new CertificateGenerator();
$certificateGenerator->saveNewCertAsFileWithKey('audit_session', $certFile);

require 'ServerClientTestCase.inc';
ServerClientTestCase::getInstance()->run($clientCode, $serverCode);

?>
--EXPECT--
Loading
Loading