Apache httpd (IBB): mod_http2, memory corruption on early pushes (CVE-2019-10081)

HTTP/2 very early pushes, for example configured with H2PushResource, could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client. Scenarios where an attacker may be able to influence response header values could potentially lead to controlled code execution. (Code execution has not been demonstrated and is unlikely with the config included here.) This issue affects versions 2.4.20 through 2.4.39. This CVE is noted on the Apache HTTPD advisory list as of August 14, 2019. Reproduction is possible under ASAN builds of HTTPD with MaxMemFree 1 and H2Push On The following supplement to the default configuration is used: Protocols h2c http/1.1 MaxMemFree 1 H2Push On H2EarlyHints On H2MaxSessionStreams 65535 H2WindowSize 65535 H2MinWorkers 5 H2MaxWorkers 32 H2MaxWorkerIdleSeconds 3 H2StreamMaxMemSize 1024 H2SerializeHeaders on H2CopyFiles on H2Padding 7 <Location /> Header add Link "</xxx.css>;rel=preload" Header add Link "</xxx.js>;rel=preload" H2PushResource /xxx2.css H2PushResource /xxx3.css H2PushResource / </Location> Under this configuration, the UAF is easily observed when handling traffic from http2fuzz. The behavior is affected by the size of responses and frequency of requests. ASAN reports for these crashes are interesting because the faulting address tends to be an ASCII string. Here is a report where it manifested as a...