Security restrictions bypass in PHP - CVE-2018-10545

Vulnerability identifier: #VU11343

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-10545

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to bypass security restrictions and obtain potentially sensitive information on the target system.

The weakness exists due to improper access controls. A local attacker can change UID and GID, PHP-FPM sets pool worker processes to be dumpable, attach to the PHP-FPM workers and gain access to any restricted resources that are not supposed to be allowed.

PHP
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
SUSE Linux
Ubuntu
Opensuse
php7 (Alpine package)
openSUSE Leap
php5-cli (Ubuntu package)
php5-cgi (Ubuntu package)
libapache2-mod-php5 (Ubuntu package)
php5-fpm (Ubuntu package)
libapache2-mod-php7.0 (Ubuntu package)
php7.0-cli (Ubuntu package)
php7.0-cgi (Ubuntu package)
php7.0-fpm (Ubuntu package)
php7.1-fpm (Ubuntu package)
php7.1-cli (Ubuntu package)
php7.1-cgi (Ubuntu package)
libapache2-mod-php7.1 (Ubuntu package)
php7.2-fpm (Ubuntu package)
php7.2-cli (Ubuntu package)
libapache2-mod-php7.2 (Ubuntu package)
php7.2-cgi (Ubuntu package)

Update to version 7.0.29 or 7.2.4.

php7 (Alpine package) - update to 7.1.30-r0
php5-cli (Ubuntu package) - update to 5.5.9+dfsg-1ubuntu4.25
php5-cgi (Ubuntu package) - update to 5.5.9+dfsg-1ubuntu4.25
libapache2-mod-php5 (Ubuntu package) - update to 5.5.9+dfsg-1ubuntu4.25
php5-fpm (Ubuntu package) - update to 5.5.9+dfsg-1ubuntu4.25
libapache2-mod-php7.0 (Ubuntu package) - update to 7.0.30-0ubuntu0.16.04.1
php7.0-cli (Ubuntu package) - update to 7.0.30-0ubuntu0.16.04.1
php7.0-cgi (Ubuntu package) - update to 7.0.30-0ubuntu0.16.04.1
php7.0-fpm (Ubuntu package) - update to 7.0.30-0ubuntu0.16.04.1
php7.1-fpm (Ubuntu package) - update to 7.1.17-0ubuntu0.17.10.1
php7.1-cli (Ubuntu package) - update to 7.1.17-0ubuntu0.17.10.1
php7.1-cgi (Ubuntu package) - update to 7.1.17-0ubuntu0.17.10.1
libapache2-mod-php7.1 (Ubuntu package) - update to 7.1.17-0ubuntu0.17.10.1
php7.2-fpm (Ubuntu package) - update to 7.2.5-0ubuntu0.18.04.1
php7.2-cli (Ubuntu package) - update to 7.2.5-0ubuntu0.18.04.1
libapache2-mod-php7.2 (Ubuntu package) - update to 7.2.5-0ubuntu0.18.04.1
php7.2-cgi (Ubuntu package) - update to 7.2.5-0ubuntu0.18.04.1

• https://bugs.php.net/bug.php?id=75605

• Multiple vulnerabilities in PHP
• SUSE Linux update for php7
• OpenSUSE Linux update for php7
• OpenSUSE Linux update for php5
• Debian update for php7.0
• Gentoo update for PHP
• Red Hat update for 389-ds-base
• Red Hat update for 389-ds-base
• Security restrictions bypass in php7 (Alpine package)
• Ubuntu update for php5, php7.0, php7.1 and more