undefined

points

by DonHopkins9 hours ago |

comments

by bombcar9 hours ago|

[-]

Amusingly enough restarting php after each request seems to block the issue

by SoftTalker8 hours ago|

parent|

[-]

If true then classic CGI mode should not be vulnerable, but apparently it is.

by quotemstr6 hours ago|

parent|

[-]

Is it? How? Yes, you can get longjmp to do invalid things, but with an ASLR reset each attempt, can you exploit it?

by SoftTalker6 hours ago|

parent|

[-]

Not sure how, but from the announcement: Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

Maybe just CYA.

by quotemstr6 hours ago|

parent|

[-]

Also, CGI PHP skips request cleanup on init failure.

I'm 90% sure CGI can't be exploited this way in default configuration with ASLR and 99% sure if PHP is configured with memory_limit=-1

That said, don't be an idiot and switch to CGI instead of patching. I'm like one of three guys running PHP in CGI mode and I'm vaguely satisfied I have the most resistant configuration.

The reason, BTW, I run PHP in CGI mode is so I can (moral equivalent of) suexec to a locked-down sandboxed environment that limits exploit blast radius. I could do the same with fcgi daemon, but the suexec is stateless, and roundcube doesn't need the performance.

In general, anything stateful or long-lived is just one more thing that can go wrong. One reason why the trend of turning everything into a persistent daemon drives me nuts.