Apache 2 HTTP2 Module Concurrent Pool Usage

CVE Category Price Severity
CVE-2020-11993 CWE-XX $XXXX High/Low/Medium/Critical
Author Risk Exploitation Type Date
Author Name Critical/High/Medium/Low Remote/Local 2020-12-08
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at:

Below is a copy:

Apache 2 HTTP2 Module Concurrent Pool Usage
apache2: concurrent pool usage in http2 module

h2_mplx.c contains a number of calls to ap_log_cerror using m->c (the master connection) as an argument. These calls can trigger allocations using the m->c->pool. 
One example is core_generate_log_id. As some of the code in h2_mplx.c is executed on a worker thread, it is possible that the main thread performs a parallel allocation and corrupts the pool. (apr memory pools are not thread-safe)
Most logging calls are using DEBUG and TRACE levels and can't be exploited in a production environment. 
However, the task_done function calls ap_log_cerror with APLOG_INFO when throttling tasks, which can be triggered by a malicious client:

        ap_log_cerror(APLOG_MARK, APLOG_INFO, 0, m->c,
                          H2_STRM_MSG(stream, \"redo, added to q\"));

This bug is subject to a 90 day disclosure deadline. After 90 days elapse, the bug report
will become visible to the public. The scheduled disclosure date is 2020-09-14.
Disclosure at an earlier date is also possible if agreed upon by all parties.

Related CVE Numbers: CVE-2020-11993.

Found by: [email protected]

Copyright ©2024 Exploitalert.

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum