CVE-2018-10545: Infoleak
A flaw was found in PHP versions 5.6 and 7.x. After changing UID and GID, PHP-FPM sets pool worker processes to be dumpable. This allows a local user with the same UID and GID to attach to the PHP-FPM workers and gain access to any restricted resources that are not supposed to be allowed. As a result sensitive configuration data for other accounts can be accessed directly in the PHP worker process's memory.
References: https://bugs.php.net/bug.php?id=75605
Patch: https://bugs.php.net/patch-display.php?bugid=75605&patch=bug75605-patch-for-5-6&revision=latest https://bugs.php.net/patch-display.php?bugid=75605&patch=bug75605-patch-for-7-0&revision=latest
Other sources
An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpmunix.c makes a PRSETDUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process.
Fixed bug (Dumpable FPM child processes allow bypassing opcache access controls). (CVE-2018-10545)
— PHP
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-php71-phpto a version that resolves this vulnerability.Fixed in 0:7.1.30-1.el7 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 5.6.35 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.0.29 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.1.16 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.2.4 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.0.29 - Upgrade
Upgrade
alpine/php7to a version that resolves this vulnerability.Fixed in 7.1.17-r0 - Upgrade
Upgrade
PHP-FPMto a version that resolves this vulnerability.Fixed in 5.6.35 - Upgrade
Upgrade
PHP-FPMto a version that resolves this vulnerability.Fixed in 7.0.29 - Upgrade
Upgrade
PHP-FPMto a version that resolves this vulnerability.Fixed in 7.1.16 - Upgrade
Upgrade
PHP-FPMto a version that resolves this vulnerability.Fixed in 7.2.4
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10545?
CVE-2018-10545 has been classified as a medium-severity vulnerability due to its potential impact on sensitive data exposure.
How do I fix CVE-2018-10545?
To resolve CVE-2018-10545, update PHP to versions 5.6.35, 7.0.29, 7.1.30, or 7.2.4 as recommended in the vendor documentation.
What versions of PHP are affected by CVE-2018-10545?
PHP versions 5.6 and 7.0.x through 7.1.x prior to 7.1.30 are vulnerable to CVE-2018-10545.
Can local users exploit CVE-2018-10545?
Yes, local users with the same UID and GID can exploit CVE-2018-10545 to attach to PHP-FPM workers.
Is CVE-2018-10545 related to PHP-FPM?
Yes, CVE-2018-10545 specifically impacts the PHP-FPM component, allowing unauthorized access to worker processes.