I came across the link via https://mastodon.social/@CuratedHackerNews/117481600704689796
Last time I touched php it was ~20 years ago and maybe for a month. Could someone with actual php understanding weigh in?
Somehow, somewhere between the lines, my understanding was that there have been observances of the vuln being used in the wild before the 14 UTC. And that wasn’t from reading news sites
From the very little I’ve researched, a DoS with it isn’t hard but for RCE one needs to know some pointers inside… doable if you assume it’s Debian or something then just download a bunch of versions locally and try them. This also implies that most hardened distributions are all unaffected (because relocations) and source builds are effectively unaffected unless the binary is dumped somehow.
Yes, and even for Debian because of ASLR, but these vulnerabilities may allow memory to be leaked and from those memory leaks an attacker can reconstruct the necessary information. That’s obviously not something just anybody could have done, but publicly available AI tools have made this level of attack complexity much more accessible. In https://www.youtube.com/watch?v=7CiZmq2llDg&t=629s they first find the vulnerability but their AI cheated to make it exploitable and then somebody else gives them a way to leak memory to figure out where things are in memory. I don’t think having errors enabled is actually necessary for the exploit to work, because if that was the case the PHP security announcement would have said “turn off errors” instead of “turn off your server now.”
blind rop? Well, if they are using AI they are unlikely to do this in a reasonable amount of time anyway. Also, not sure how one would go on with that if all protectors and pointers change every run and fork like on OpenBSD.