{"id":183943,"date":"2026-10-22T05:40:56","date_gmt":"2026-10-22T03:40:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/raskryty-detali-kriticheskih-uyazvimostej-v-php-i-opublikovany-korrektiruyushhie-obnovleniya"},"modified":"2026-10-22T05:41:02","modified_gmt":"2026-10-22T03:41:02","slug":"details-of-critical-php-vulnerabilities-disclosed-and-security-updates-released","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/details-of-critical-php-vulnerabilities-disclosed-and-security-updates-released","title":{"rendered":"Atkl\u0101ti kritisku ievainojam\u012bbu detaliz\u0113jumi PHP un public\u0113ti labojumizlaidumi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Ir izlaisti labojumi PHP 8.5.12, 8.4.27, 8.3.36 un 8.2.35, k\u0101 ar\u012b uzlabojumi jau neatbalst\u012bt\u0101m PHP 7.4, PHP 8.0 un PHP 8.1 versij\u0101m (vulnerablas versijas no 5.4 l\u012bdz 7.3 paliek bez labojumiem), kuros ir atrastas divas kritiskas ievainojam\u012bbas:<\/p>\n
\n
CVE-2026-109618 \u2014 att\u0101lin\u0101tas izpildes kods, ko izraisa tas, ka, kad beidzas pieejam\u0101 procesa br\u012bv\u0101 atmi\u0146a, atmi\u0146as tr\u016bkuma apstr\u0101des programma, izsaucot longjmp() funkciju, var p\u0101rtraukt PHP interpretatoru st\u0101vokl\u012b, kad ir inicializ\u0113tas tikai da\u013cas no iek\u0161\u0113j\u0101m strukt\u016br\u0101m, kas saist\u012btas ar piepras\u012bjuma apstr\u0101di. P\u0113c tam piepras\u012bjuma apstr\u0101des funkcija attiecas uz \u0161\u012bm strukt\u016br\u0101m k\u0101 uz jau inicializ\u0113t\u0101m, lai gan atmi\u0146a t\u0101m nav pie\u0161\u0137irta.\n
Galvenais uzbrukuma virziens ir manipul\u0101cija ar multipart piepras\u012bjumiem, lai rad\u012btu apst\u0101k\u013cus pieejam\u0101s procesa atmi\u0146as izs\u012bkumam. Lai apietu ierobe\u017eojumu post_max_size, var netikt nor\u0101d\u012bts Content-Length galvene un tikt var p\u0101rs\u016bt\u012bts milz\u012bgs skaits HTTP galvenu. Ir iesp\u0113jams veikt ar\u012b m\u0113r\u0137tiec\u012bgus uzbrukumus konkr\u0113t\u0101m oper\u0101cij\u0101m php lietojumprogramm\u0101s, kuras p\u0101rm\u0113r\u012bgi pat\u0113r\u0113 atmi\u0146u. Eksploz\u012bva apstiprin\u0101jums ir saist\u012bts ar mod_php, jo tas izsauc shutdown() funkciju pat k\u013c\u016bmes gad\u012bjum\u0101. PHP-FPM, ja notiek k\u013c\u016bme, pabeigs apak\u0161procesu, kas apgr\u016btina uzbrukuma veik\u0161anu, ta\u010du teor\u0113tiski to nenov\u0113r\u0161. <\/p>\n
CVE-2026-109619 \u2014 att\u0101lin\u0101tas izpildes kods, ko izraisa piek\u013cuve atmi\u0146ai p\u0113c t\u0101s atbr\u012bvo\u0161anas, nepareizi izt\u012brot glob\u0101lo st\u0101vokli, kas saist\u012bts ar konkr\u0113tu piepras\u012bjumu. Ja piepras\u012bjums tiek p\u0101rtraukts nopietnas k\u013c\u016bdas, laika ierobe\u017eojuma vai atmi\u0146as tr\u016bkuma d\u0113\u013c, glob\u0101lais st\u0101voklis var palikt nesak\u0101rtots un r\u0101d\u012bjumi paliks akt\u012bvi, neskatoties uz atmi\u0146as atbr\u012bvo\u0161anu, uz kuru tie atsaucas. Apstr\u0101d\u0101jot n\u0101kamo piepras\u012bjumu taj\u0101 pa\u0161\u0101 proces\u0101, var rasties piek\u013cuve paliku\u0161ajam r\u0101d\u012bt\u0101jam uz veco glob\u0101lo st\u0101vokli.\n
Lai izmantotu, var rad\u012bt apst\u0101k\u013cus, vai ekspluat\u0113t pieejam\u0101s atmi\u0146as izs\u012bk\u0161anu multipart piepras\u012bjuma apstr\u0101d\u0113, izmantojot kodu progresu aug\u0161upiel\u0101d\u0113 (session.upload_progress). \u0160aj\u0101 gad\u012bjum\u0101 k\u0101 galvenais un apstiprin\u0101tais uzbrukuma virziens tiek min\u0113ts fatal_error_backtraces apstr\u0101d\u0101t\u0101js PHP 8.5, kas nesl\u0113dz izsist\u0101s k\u013c\u016bdas st\u0101vokli p\u0113c beig\u0101m. Pirmaj\u0101 gad\u012bjum\u0101 uzbrukums ir iesp\u0113jams uz mod_php un PHP-FPM, bet otraj\u0101 tikai uz mod_php. T\u0101pat tiek min\u0113ta neapstiprin\u0101ta iesp\u0113ja veikt uzbrukumu konfigur\u0101cij\u0101s, kur iestat\u012bjumi izraisa br\u012bdin\u0101jumu izvad\u012b\u0161anu agr\u012bn\u0101 piepras\u012bjuma apstr\u0101des posm\u0101 (piem\u0113ram, br\u012bdin\u0101jumi par novecoju\u0161iem parametriem).<\/p>\n<\/ul>\n
Tiek apgalvots, ka piln\u012bga ievainojam\u012bbas blo\u0137\u0113\u0161ana ir iesp\u0113jama tikai, ja tiek uzst\u0101d\u012bts jaunin\u0101jums. N\u0101kamie pas\u0101kumi samazina veiksm\u012bgu uzbrukumu varb\u016bt\u012bbu, ta\u010du nepadara sist\u0113mu piln\u012bgi dro\u0161u:<\/p>\n
\n
php.ini parametra iestat\u012b\u0161ana «memory_limit=-1», kas apgr\u016btina uzbruc\u0113ja kontroli p\u0101r atmi\u0146as limitu izs\u012bk\u0161anu.\n
Post_max_size parametra iestat\u012b\u0161ana uz «post_max_size = 8M», ja nav nepiecie\u0161ams aug\u0161upiel\u0101d\u0113t lielus failus. Parametra «upload_max_filesize» v\u0113rt\u012bbai j\u0101b\u016bt maz\u0101kai par «post_max_size» parametra v\u0113rt\u012bbu.\n
Iestata pie\u013caujamo atmi\u0146as lieto\u0161anas limitu sist\u0113mas l\u012bmen\u012b, izmantojot cgroup memory.max vai konteineru atmi\u0146as lieto\u0161anas parametrus, bet ne caur sist\u0113mas limit\u0113m RLIMIT_AS un RLIMIT_DATA, kas tikai provoc\u0113 probl\u0113mu ar longjmp().\n
Ja sniegums nav svar\u012bgs, var ierobe\u017eot piepras\u012bjumu skaitu, ko apstr\u0101d\u0101 viens darba process, izmantojot pm.max_requests=1 PHP-FPM un MaxRequestsPerChild Apache httpd.\n