Bug #73342 [Asn->Opn]: Vulnerability in php-fpm by changing stdin to non-blocking

Edit report at https://bugs.php.net/bug.php?id=73342&edit=1 ID: 73342 Updated by: cmb@php.net Reported by: xuavis at gmail dot com Summary: Vulnerability in php-fpm by changing stdin to non-blocking -Status: Assigned +Status: Open Type: Bug Package: FPM related Operating System: Ubuntu 16.04 PHP Version: 7.0Git-2016-10-18 (Git) -Assigned To: fat +Assigned To: Block user comment: N Private report: N New Comment: Unassigning from Jérôme, since his latest commit has been more than 4 years ago. Hopefully, somebody else will tackle this issue this way. Previous Comments: ------------------------------------------------------------------------ [2016-10-19 07:36:34] xuavis at gmail dot com The case I could think of (and the reason I did choose Security as type) was due to shared hosting providers; Running multiple users on the same server where a single user can, as far as I know, (almost) undetectable use this to cause high load leading to a Denial of Service which affects other users. ------------------------------------------------------------------------ [2016-10-19 05:37:41] krakjoe@php.net Agree with stas, not a sec issue. ------------------------------------------------------------------------ [2016-10-19 05:33:55] stas@php.net Not sure how it's security issue. If you can run code on this server, you have already crossed security border. ------------------------------------------------------------------------ [2016-10-18 20:16:37] xuavis at gmail dot com The patch I think I added doesn't show for me. You can also find it at https://gist.github.com/anonymous/080bdb43fe9a0eb57609a93e9e4dd093 ------------------------------------------------------------------------ [2016-10-18 20:02:48] xuavis at gmail dot com Description: ------------ Tested on php 5.6 and 7.0 on both Ubuntu and FreeBSD. When changing STDIN to non-blocking (see test script), php-fpm child processes start crashing. This causes rapid restarting of child processes with high cpu load. This can be exploited for denial of service. Also scripts start getting cut off during execution. Sometimes the master php-fpm process also stops responding to a restart/stop and requires a SIGKILL to stop. Test script: --------------- <?php stream_set_blocking(fopen('php://stdin', 'r'), false); Expected result: ---------------- strace of child: write(3, "\1\6\0\1\0S\5\0X-Powered-By: PHP/5.6.27"..., 112) = 112 shutdown(3, SHUT_WR) = 0 recvfrom(3, "\1\5\0\1\0\0\0\0", 8, 0, NULL, NULL) = 8 recvfrom(3, "", 8, 0, NULL, NULL) = 0 close(3) = 0 setitimer(ITIMER_PROF, {it_interval={0, 0}, it_value={0, 0}}, NULL) = 0 accept(0, strace: Process 19005 detached clean php-fpm log Actual result: -------------- strace of child: write(3, "\1\6\0\1\0S\5\0X-Powered-By: PHP/5.6.27"..., 112) = 112 shutdown(3, SHUT_WR) = 0 recvfrom(3, "\1\5\0\1\0\0\0\0", 8, 0, NULL, NULL) = 8 recvfrom(3, "", 8, 0, NULL, NULL) = 0 close(3) = 0 setitimer(ITIMER_PROF, {it_interval={0, 0}, it_value={0, 0}}, NULL) = 0 accept(0, 0x7ffeb7a996c0, 0x7ffeb7a996b0) = -1 EAGAIN (Resource temporarily unavailable) php-fpm log: [17-Oct-2016 23:28:49.808690] NOTICE: pid 748, fpm_children_bury(), line 252: [pool www] child 6300 exited with code 0 after 0.001693 seconds from start [17-Oct-2016 23:28:49.808927] NOTICE: pid 748, fpm_children_make(), line 421: [pool www] child 6301 started [17-Oct-2016 23:28:49.808946] DEBUG: pid 748, fpm_event_loop(), line 419: event module triggered 1 events [17-Oct-2016 23:28:49.810581] DEBUG: pid 748, fpm_got_signal(), line 76: received SIGCHLD [17-Oct-2016 23:28:49.810611] NOTICE: pid 748, fpm_children_bury(), line 252: [pool www] child 6301 exited with code 0 after 0.001690 seconds from start [17-Oct-2016 23:28:49.810833] NOTICE: pid 748, fpm_children_make(), line 421: [pool www] child 6302 started [17-Oct-2016 23:28:49.810852] DEBUG: pid 748, fpm_event_loop(), line 419: event module triggered 1 events [17-Oct-2016 23:28:49.812501] DEBUG: pid 748, fpm_got_signal(), line 76: received SIGCHLD [17-Oct-2016 23:28:49.812533] NOTICE: pid 748, fpm_children_bury(), line 252: [pool www] child 6302 exited with code 0 after 0.001706 seconds from start [17-Oct-2016 23:28:49.812750] NOTICE: pid 748, fpm_children_make(), line 421: [pool www] child 6303 started [17-Oct-2016 23:28:49.812771] DEBUG: pid 748, fpm_event_loop(), line 419: event module triggered 1 events [17-Oct-2016 23:28:49.814332] DEBUG: pid 748, fpm_got_signal(), line 76: received SIGCHLD [17-Oct-2016 23:28:49.814362] NOTICE: pid 748, fpm_children_bury(), line 252: [pool www] child 6303 exited with code 0 after 0.001618 seconds from start [17-Oct-2016 23:28:49.814585] NOTICE: pid 748, fpm_children_make(), line 421: [pool www] child 6304 started ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=73342&edit=1