Bug #73342 [Com]: Vulnerability in php-fpm by changing stdin to non-blocking

Edit report at https://bugs.php.net/bug.php?id=73342&edit=1 ID: 73342 Comment by: yago dot riveiro at gmail dot com Reported by: xuavis at gmail dot com Summary: Vulnerability in php-fpm by changing stdin to non-blocking Status: Open Type: Bug Package: FPM related Operating System: Ubuntu 16.04 PHP Version: 7.0Git-2016-10-18 (Git) Block user comment: N Private report: N New Comment: This bug with Centos 7.0 and php 7 can be reproduced too Previous Comments: ------------------------------------------------------------------------ [2016-10-25 17:25:12] cmb@php.net Unassigning from Jérôme, since his latest commit has been more than 4 years ago. Hopefully, somebody else will tackle this issue this way. ------------------------------------------------------------------------ [2016-10-19 07:36:34] xuavis at gmail dot com The case I could think of (and the reason I did choose Security as type) was due to shared hosting providers; Running multiple users on the same server where a single user can, as far as I know, (almost) undetectable use this to cause high load leading to a Denial of Service which affects other users. ------------------------------------------------------------------------ [2016-10-19 05:37:41] krakjoe@php.net Agree with stas, not a sec issue. ------------------------------------------------------------------------ [2016-10-19 05:33:55] stas@php.net Not sure how it's security issue. If you can run code on this server, you have already crossed security border. ------------------------------------------------------------------------ [2016-10-18 20:16:37] xuavis at gmail dot com The patch I think I added doesn't show for me. You can also find it at https://gist.github.com/anonymous/080bdb43fe9a0eb57609a93e9e4dd093 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=73342 -- Edit this bug report at https://bugs.php.net/bug.php?id=73342&edit=1