Bug #73342 [Ver]: Vulnerability in php-fpm by changing stdin to non-blocking

Edit report at https://bugs.php.net/bug.php?id=73342&edit=1 ID: 73342 Updated by: nikic@php.net Reported by: xuavis at gmail dot com Summary: Vulnerability in php-fpm by changing stdin to non-blocking Status: Verified Type: Bug Package: FPM related Operating System: Ubuntu 16.04 PHP Version: 7.0Git-2016-10-18 (Git) Assigned To: bukka Block user comment: N Private report: N New Comment: @bukka: Thanks for the update. That sounds like things might still take a while, in which case I will go ahead and merge this patch now. We can't afford to delay this issue by an indeterminate amount of time, and given the production testing by kenny at kennynet dot co dot uk, I believe we can be sufficiently confident in the correctness of the change. Previous Comments: ------------------------------------------------------------------------ [2018-06-12 15:47:00] bukka@php.net @nikic Yep that's sort of the plan. I want to finish the fpm logging changes and then will try to look on this one and other stuff. Can't really give you an ETA but hopefully it won't take too long. Will see. ;) ------------------------------------------------------------------------ [2018-06-12 09:03:45] kenny at kennynet dot co dot uk We've seen no problems yet with the proposed patch in our internal infrastructure and we've applied it against both 7.0 and 7.2. ------------------------------------------------------------------------ [2018-06-11 13:06:54] nikic@php.net @bukka: What's the ETA on getting this merged? I saw that you submitted the PR for the fpm test revamp, so I assume that we'll start landing outstanding fpm patches soon? ------------------------------------------------------------------------ [2018-06-11 12:39:23] alex at sirensclef dot com I'm under some pressure to put together a production PHP 7.2 + FPM setup, but then I ran head first into this bug. I don't know what's worse... that a critical subset of PHP functionality is incompatible with PHP-FPM, or that this has been known for so long and nothing has been done. Is anyone aware of a workaround (other than this patch being evaluated)? I've got more of a mod_php background so I'm only just developing an understanding of the options here, but I've had no luck making adjustments to neutralize the issue. I've tested an option, for a dev server, that uses a cron to check the php-fpm log every minute and restart the service whenever the issue arises, but I can't put that into production. Worried this setup is simply a non-starter. ------------------------------------------------------------------------ [2018-04-24 06:10:05] gksalil at gmail dot com Hello Is the patch working and fix the issue ? Can I apply this patch safely ? Thanks ~S ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=73342 -- Edit this bug report at https://bugs.php.net/bug.php?id=73342&edit=1