Remix clone Hacker News

new | show | ask | jobs Github

▲

bombcar 5 hours ago

Amusingly enough restarting php after each request seems to block the issue

▲

SoftTalker 4 hours ago | parent [-]

If true then classic CGI mode should not be vulnerable, but apparently it is.

▲

quotemstr 2 hours ago | parent [-]

Is it? How? Yes, you can get longjmp to do invalid things, but with an ASLR reset each attempt, can you exploit it?

▲

SoftTalker 2 hours ago | parent [-]

Not sure how, but from the announcement: Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

Maybe just CYA.

	▲	quotemstr 2 hours ago \| parent [-]
		Also, CGI PHP skips request cleanup on init failure. I'm 90% sure CGI can't be exploited this way in default configuration with ASLR and 99% sure if PHP is configured with memory_limit=-1 That said, don't be an idiot and switch to CGI instead of patching. I'm like one of three guys running PHP in CGI mode and I'm vaguely satisfied I have the most resistant configuration. The reason, BTW, I run PHP in CGI mode is so I can (moral equivalent of) suexec to a locked-down sandboxed environment that limits exploit blast radius. I could do the same with fcgi daemon, but the suexec is stateless, and roundcube doesn't need the performance. In general, anything stateful or long-lived is just one more thing that can go wrong. One reason why the trend of turning everything into a persistent daemon drives me nuts.