Iconv, Set the Charset to RCE: Exploiting glibc to Hack the PHP Engine
Transforming the CVE-2024-2961 glibc iconv buffer overflow into remote code execution across PHP applications.
Summary
Discovery of Buffer Overflow CVE 2024 2961
Upon its discovery, CVE-2024-2961, a very old buffer overflow in the glibc, seemed like a terrible bug. Within the prism of the PHP engine, however, the vulnerability shone, and provided both a new remote code execution vector and a few 0-days.
Exploiting glibc iconv Through PHP Filters
This talk will first walk you through the discovery of the bug and its limitations, before describing the conception of remote binary PHP exploits using this bug, and through them offer unique insight in the internal of the engine of the web language, and the difficulties one faces when exploiting it.
Turning Memory Corruption into Stable RCE
After this, it will reveal the impact on PHP's ecosystem, from well-known functions to unsuspected sinks, by showcasing the vulnerability on several popular libraries and applications.
Related talks
Main Stage·35 min
Ji'an Zhou · Lishuo Song
Discloses multiple memory corruption and deserialization vulnerabilities in PyTorch's TorchScript JIT engine that allow arbitrary remote code execution via malicious AI models.
Main Stage·34 min
Ji'an Zhou · Ying Zhu · ZiYang Li
Reveals critical architectural and deserialization vulnerabilities across Apache Kafka client and server implementations, enabling remote code execution.
Main Stage·39 min
Anna Antonenko
Demonstrates remote code execution across audio software and operating system synthesis engines by weaponizing malformed MIDI protocol messages.