Summary
Usate of AES-WRAP-PAD can result in memory corruption and abort of application.
Details
The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. Key-wrap-with-pad rounds the plaintext up to the next 8-byte boundary and prepends an 8-byte AIV, so ciphertext length is roundup(len, 8) + 8, not a function of the raw input length. The zend_string PHP allocates is therefore too small for what OpenSSL's EVP_EncryptUpdate/EVP_EncryptFinal writes.
OpenSSL writes the full wrapped output past the end of the undersized heap allocation, corrupting adjacent Zend MM heap metadata. This surfaces as the zend_mm_heap corrupted abort — the allocator detecting corrupted bookkeeping on a later operation, not at the moment of the overflow.
Further details in #22186
Impact
If the attacker is able to find implementation using this rarely used algorithm, it can potentially abort the application and possibly cause DoS for the application.
Summary
Usate of AES-WRAP-PAD can result in memory corruption and abort of application.
Details
The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. Key-wrap-with-pad rounds the plaintext up to the next 8-byte boundary and prepends an 8-byte AIV, so ciphertext length is roundup(len, 8) + 8, not a function of the raw input length. The zend_string PHP allocates is therefore too small for what OpenSSL's EVP_EncryptUpdate/EVP_EncryptFinal writes.
OpenSSL writes the full wrapped output past the end of the undersized heap allocation, corrupting adjacent Zend MM heap metadata. This surfaces as the zend_mm_heap corrupted abort — the allocator detecting corrupted bookkeeping on a later operation, not at the moment of the overflow.
Further details in #22186
Impact
If the attacker is able to find implementation using this rarely used algorithm, it can potentially abort the application and possibly cause DoS for the application.