points by pizlonator 2 days ago | 0 comments
This is all it takes to port PHP to Fil-C and according to our tests this turns all of the exploits into DoS
https://github.com/pizlonator/fil-c/blob/deluge/projects/php...
[–] ericol 2 days ago
Which tests, and against which PoCs? The public php2shell kits already crash workers on stock 8.4 (8/8 crash, 0/8 shell) — so "turned into DoS" may be the status quo, not your result.
And firing the OOM is memory_limit working as designed, not exploiting a system.
Pix, or GTFO.
Have you been able to run any benchmarks? (Are there any benchmarks for this kind of thing?) IDK, seems kind of silly when talking about PHP and webservers but people were concerned when I suggested it in the original thread.
In particular, it is mentioned that the `Zend` allocator does not play well with fine-grained tracking (so would not have caught this issue?) and you need to swap to the system allocator.