mod_http2, memory corruption on early pushes (CVE-2019-10081)
该报告还没有中文解读。
原文摘录
摘自原文（9112 字符中的一小部分）
HTTP/2 very early pushes, for example configured with `H2PushResource`, could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client. Scenarios where an attacker may be …
原文中的代码
Protocols h2c http/1.1
MaxMemFree 1
H2Push On
H2EarlyHints On
H2MaxSessionStreams 65535
H2WindowSize 65535
H2MinWorkers 5
H2MaxWorkers 32
H2MaxWorkerIdleSeconds 3
H2StreamMaxMemSize 1024
H2SerializeHeaders on
H2CopyFiles on
H2Padding 7
<Location />
Header add Link "</xxx.css>;rel=preload" …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @cy1337 · 版权归作者与 Internet Bug Bounty 所有