Apache Httpd 2.4.18 Exploit !free! Review

The front-end proxy views the packet as a single request and passes it forward. Apache 2.4.18 misinterprets the whitespace, truncating the stream and reading the remaining data as a separate, second hidden request.

When Apache performs a graceful restart (often triggered by logrotate at 6:25 AM on many Linux systems), the main process kills the old workers and creates new ones. At this point, the main process reads each old worker's bucket index from the shared memory and uses it to access an element in the all_buckets array. However, a poorly implemented out-of-bounds array access, combined with a use-after-free condition, allows a worker process to overwrite the bucket field in the shared memory with a malicious value. When the main process later uses this value as an index into all_buckets , it reads from a location controlled by the attacker. apache httpd 2.4.18 exploit