mod_http2, read-after-free in h2 connection shutdown (CVE-2019-10082)
该报告还没有中文解读。
原文摘录
摘自原文（9489 字符中的一小部分）
Using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown. This is made possible by a race condition in which nghttp2 maintains a reference to a stream after mod_http2 has destroyed it.
原文中的代码
=================================================================
==22097==ERROR: AddressSanitizer: heap-use-after-free on address 0x6250042609b8 at pc 0x0000008d63f3 bp 0x7fd8c39f9420 sp 0x7fd8c39f9410
READ of size 4 at 0x6250042609b8 thread T1044
#0 0x8d63f2 in h2_stream_send_frame …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @cy1337 · 版权归作者与 Internet Bug Bounty 所有