Bug #76067 [Asn->Csd]: system() function call leaks php-fpm listening sockets

Edit report at https://bugs.php.net/bug.php?id=76067&edit=1 ID: 76067 Updated by: bukka@php.net Reported by: jaco at uls dot co dot za Summary: system() function call leaks php-fpm listening sockets -Status: Assigned +Status: Closed Type: Bug Package: FPM related Operating System: Linux PHP Version: 5.6.34 Assigned To: bukka Block user comment: N Private report: N New Comment: This has been addressed by https://github.com/php/php-src/commit/418cdc0bea3d7787587964f42c309602d70232c6 and will be available in PHP 8.3.0. Previous Comments: ------------------------------------------------------------------------ [2020-08-31 08:32:48] jaco at uls dot co dot za We host customer code ... so telling me a workaround is to do system("... &>/dev/null") or some variant thereof (killing off fd per fd) is just absolutely stupid insane. More to the point, fd=0 is original listening socket. So a remote hack can start doing accept() and intercepting posts, which could include login credentials. With some trickery it can forward this to legitimate processors conceivably, thus effectively installing a MITM right on the hosting machine. This is an escalation attack, so first need to exploit something else before this can be directly attacked. ------------------------------------------------------------------------ [2020-04-29 22:00:50] enyby at yandex dot ru Workaround for run $command in exec: exec $command 3>&- 4>&- 5>&- 6>&- 7>&- 8>&- 9>&- 10>&- 11>&- 12>&- 13>&- 14>&- 15>&- 16>&- 17>&- 18>&- 19>&- 20>&- 21>&- 22>&- 23>&- 24>&- 25>&- 26>&- 27>&- 28>&- 29>&- 30>&- In code it is look like: $command = 'exec '.$command.' '.implode('>&- ', range(3, 30)).'>&-'; Now original command will use only fds 0, 1 and 2. With defined explicit on exec. Require bash which understand syntax 'fd>&-' for close fd. ------------------------------------------------------------------------ [2020-04-29 21:14:07] enyby at yandex dot ru Same issue but with PHP 7.3.9. As mentioned in #67383 this bug prevent restart php-fpm. ------------------------------------------------------------------------ [2018-10-14 15:54:21] bukka@php.net Seems fine now and it's publicly visible. ------------------------------------------------------------------------ [2018-10-14 15:44:34] bukka@php.net Seems like it's still set as private but I can't change it. Think it should be set as a public. Can someone with the right permission do that? ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=76067 -- Edit this bug report at https://bugs.php.net/bug.php?id=76067&edit=1