Bug #73342 [Com]: Vulnerability in php-fpm by changing stdin to non-blocking

Edit report at https://bugs.php.net/bug.php?id=73342&edit=1 ID: 73342 Comment by: matt at datacodesolutions dot com Reported by: xuavis at gmail dot com Summary: Vulnerability in php-fpm by changing stdin to non-blocking Status: Open Type: Bug Package: FPM related Operating System: Ubuntu 16.04 PHP Version: 7.0Git-2016-10-18 (Git) Block user comment: N Private report: N New Comment: This bug is causing issues on our server (Centos 7 / WHM / PHP 70) as well - high load which in turn cause extremely slow performance. We use shell_exec to generate PDFs and it seems like this is causing the PHP-FPM service to get stuck in an endless loop of trying to start and then exiting. https://serverfault.com/questions/839135/nginx-php-fpm-child-exited-with-code-0 [16-Jul-2017 12:49:45] NOTICE: [pool mysite_com] child 62666 exited with code 0 after 0.103145 seconds from start [16-Jul-2017 12:49:45] NOTICE: [pool mysite_com] child 62675 started [16-Jul-2017 12:49:45] NOTICE: [pool mysite_com] child 62665 exited with code 0 after 0.108670 seconds from start [16-Jul-2017 12:49:45] NOTICE: [pool mysite_com] child 62676 started [16-Jul-2017 12:49:45] NOTICE: [pool mysite_com] child 62667 exited with code 0 after 0.111453 seconds from start [16-Jul-2017 12:49:45] NOTICE: [pool mysite_com] child 62677 started [16-Jul-2017 12:49:45] NOTICE: [pool mysite_com] child 62668 exited with code 0 after 0.112478 seconds from start [16-Jul-2017 12:49:45] NOTICE: [pool mysite_com] child 62678 started [16-Jul-2017 12:49:45] NOTICE: [pool mysite_com] child 62669 exited with code 0 after 0.098957 seconds from start [16-Jul-2017 12:49:45] NOTICE: [pool mysite_com] child 62679 started [16-Jul-2017 12:49:45] NOTICE: [pool mysite_com] child 62671 exited with code 0 after 0.094954 seconds from start [16-Jul-2017 12:49:45] NOTICE: [pool mysite_com] child 62680 started [16-Jul-2017 12:49:45] NOTICE: [pool mysite_com] child 62670 exited with code 0 after 0.101192 seconds from start Previous Comments: ------------------------------------------------------------------------ [2017-05-16 09:05:09] yago dot riveiro at gmail dot com This bug with Centos 7.0 and php 7 can be reproduced too ------------------------------------------------------------------------ [2016-10-25 17:25:12] cmb@php.net Unassigning from Jérôme, since his latest commit has been more than 4 years ago. Hopefully, somebody else will tackle this issue this way. ------------------------------------------------------------------------ [2016-10-19 07:36:34] xuavis at gmail dot com The case I could think of (and the reason I did choose Security as type) was due to shared hosting providers; Running multiple users on the same server where a single user can, as far as I know, (almost) undetectable use this to cause high load leading to a Denial of Service which affects other users. ------------------------------------------------------------------------ [2016-10-19 05:37:41] krakjoe@php.net Agree with stas, not a sec issue. ------------------------------------------------------------------------ [2016-10-19 05:33:55] stas@php.net Not sure how it's security issue. If you can run code on this server, you have already crossed security border. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=73342 -- Edit this bug report at https://bugs.php.net/bug.php?id=73342&edit=1