# mod_http2, memory corruption on early pushes (CVE-2019-10081)

mod_http2 early pushes overwrite the pushing request's pool memory, letting a remote unauthenticated attacker crash Apache httpd (2.4.20-2.4.39) and potentially execute code.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: cy1337
- Disclosed: 2019-10-15
- CVE: CVE-2019-10081
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/677557
- Library page: https://bugbountylibrary.com/r/h1%3A677557
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:high tech:linux technique:fuzzing technique:source-review vuln:dos vuln:memory-corruption

**Target:** Apache httpd mod_http2 (H2PushResource / early pushes)
**Root cause:** Very early HTTP/2 pushes overwrite memory in the pushing request's pool; the copied data is the configured push Link header values, and the freed pool is later reused, causing a use-after-free.
**Steps:**
1. Build httpd 2.4.39 with ASAN.
2. Configure `Protocols h2c http/1.1`, `MaxMemFree 1`, `H2Push On`, `H2EarlyHints On`, `H2MaxSessionStreams 65535`, `H2WindowSize 65535`, `H2StreamMaxMemSize 1024`, `H2SerializeHeaders on`, `H2CopyFiles on`, `H2Padding 7`.
3. Add `Header add Link "</xxx.css>;rel=preload"`, `Header add Link "</xxx.js>;rel=preload"`, and `H2PushResource /xxx2.css`, `/xxx3.css`, `/`.
4. Send traffic with http2fuzz against the server.
5. Observe ASAN SEGV with faulting address being an ASCII string (e.g. `0x44415445` == "DATE", or `bPPUSP`).
**How found:** Fuzzing mod_http2 with http2fuzz under ASAN with aggressive pool settings (MaxMemFree 1) and early pushes enabled; noticed faulting addresses were ASCII strings, indicating pool memory holding header values was being reused after free.
**Exploitation:** Remote unauthenticated attacker sends HTTP/2 traffic triggering early pushes; the pushing request's pool memory is overwritten and later freed/reused, crashing the worker (DoS). Code execution is theoretically possible only if the attacker can influence response header values, which was not demonstrated.
**Insight:** Set MaxMemFree 1 under ASAN to force pool reuse and surface UAFs in Apache module code; ASCII-looking fault addresses in ASAN traces are a strong hint that freed pool memory holding header strings is being dereferenced.