Summary

Usate of AES-WRAP-PAD can result in memory corruption and abort of application.

Details

The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. Key-wrap-with-pad rounds the plaintext up to the next 8-byte boundary and prepends an 8-byte AIV, so ciphertext length is roundup(len, 8) + 8, not a function of the raw input length. The zend_string PHP allocates is therefore too small for what OpenSSL's EVP_EncryptUpdate/EVP_EncryptFinal writes.

OpenSSL writes the full wrapped output past the end of the undersized heap allocation, corrupting adjacent Zend MM heap metadata. This surfaces as the zend_mm_heap corrupted abort — the allocator detecting corrupted bookkeeping on a later operation, not at the moment of the overflow.

Further details in https://github.com/php/php-src/issues/22186

Impact

If the attacker is able to find implementation using this rarely used algorithm, it can potentially abort the application and possibly cause DoS for the application.