#!/usr/bin/env bash # ============================================================================== # SYNOPSIS # Applies the PHP advisory workaround for CVE-2026-109618 (OOM memory corruption, "php2shell"). # # DESCRIPTION # CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) is a memory corruption in PHP request handling on the # out-of-memory path that a crafted HTTP request can turn into unauthenticated remote code # execution. It affects every PHP that serves web requests before 8.2.35, 8.3.36, 8.4.27 and # 8.5.12. The advisory names "memory_limit=-1, enforced administratively" as the primary # configuration mitigation when PHP cannot be updated yet. This script finds the exposed PHP # web interfaces (same logic as the x_detection script: affected version, no backported fix, # in use, workaround not in place) and, for each one: # - PHP-FPM: adds "php_admin_value[memory_limit] = -1" right after every pool header (other # memory_limit overrides in the pools are commented out), validates with "php-fpm -t" and # reloads gracefully (systemctl reload, or USR2 to the master). # - Apache mod_php: writes zz-vicarius-cve-2026-109618.conf (conf-available + conf-enabled on # Debian/Ubuntu, conf.d on RHEL) with "php_admin_value memory_limit -1", validates with # "apachectl -t" and reloads gracefully. Other Apache directives that set memory_limit are # reported, not changed. # - php-cgi, LiteSpeed and FrankenPHP: no administrative setting is supported; reported. # It then re-reads the effective configuration ("php-fpm -tt", Apache files) to verify. # Every changed file is backed up under STATE_ROOT and a rollback-.sh is written. # Output: log lines, then exactly one last line # RESULT=CVE-2026-109618|MITIGATED|TRUE workaround applied and verified, or not exposed # RESULT=CVE-2026-109618|MITIGATED|FALSE still exposed (dry-run, failure; exit 1 on a real error) # This is a mitigation, not a patch: updating PHP is the only complete fix. # Source: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w # VARIABLES TO DEFINE: # # DRY_RUN=false # optional — true only reports what would change (verdict FALSE while exposed) # # STATE_ROOT="/var/lib/vicarius/CVE-2026-109618" # optional — backups and rollback script # # REQUIRE_ACTIVE_WEB_SAPI=true # optional — true: only interfaces in use; false: any installed # # COMMAND_TIMEOUT=60 # optional — maximum seconds for any external command # WARNINGS: # # Requires root. Modifies PHP-FPM pool files and adds an Apache configuration file, then # # reloads PHP-FPM and Apache gracefully (no dropped connections, workers are recycled). # # memory_limit=-1 removes the per-request memory cap: one request can use all server memory. # # Keep a container/cgroup memory limit and restore a real memory_limit after updating PHP # # (run the rollback script). Do not use RLIMIT_AS or RLIMIT_DATA instead: they trigger the bug. # # DISCLAIMER # VICARIUS STRONGLY RECOMMENDS RUNNING THESE SCRIPTS IN A TEST LAB ENVIRONMENT # BEFORE DEPLOYING THEM TO PRODUCTION. USE AT YOUR OWN DISCRETION ONLY AFTER # CAREFULLY ANALYZING THE CODE. # # AUTHOR # This script has been made by Vicarius Research Team # # VERSION # 1.0 # ============================================================================== # ---------------- Configuration (edit only this block) ---------------- # true = only report what would change (verdict FALSE while the host is exposed). Default false: apply. DRY_RUN=false # Folder for backups of the original files and the rollback script (absolute path). STATE_ROOT="/var/lib/vicarius/CVE-2026-109618" # true = only PHP web interfaces in use count (running, enabled service or Apache module loaded); false = any installed. REQUIRE_ACTIVE_WEB_SAPI=true # Maximum seconds for any single external command. COMMAND_TIMEOUT=60 # ---------------------------------------------------------------------- set -u set -o pipefail CVE_ID="CVE-2026-109618" # Upstream releases with the fix, one per supported branch (GHSA-w8hw-w9fx-j79w). Newer branches are fixed. FIXED_UPSTREAM=("8.2.35" "8.3.36" "8.4.27" "8.5.12") LAST_AFFECTED_BRANCH="8.5" # Distribution builds with the fix backported: " " (Ubuntu USN-8948-1/-2, Debian DSA-6574-1/DLA-4848-1). DEB_FIXED=("php8.5 8.5.9-0ubuntu2.1" "php8.5 8.5.4-0ubuntu1.5" "php8.3 8.3.6-0ubuntu0.24.04.13" "php8.1 8.1.2-1ubuntu2.28" "php7.4 7.4.3-4ubuntu2.29+esm5" "php7.2 7.2.24-0ubuntu0.18.04.17+esm14" "php7.0 7.0.33-0ubuntu0.16.04.16+esm22" "php5 5.5.9+dfsg-1ubuntu4.29+esm18" "php8.2 8.2.35-1~deb12u1" "php8.4 8.4.27-1~deb13u1") # " " (Red Hat CSAF for the CVE). RPM_FIXED=("php 8.0.30-8.el9_8.1") # A package changelog naming this ID means the fix was backported. CHANGELOG_PATTERN="CVE-2026-109618" # Marker line written before the settings added to each PHP-FPM pool. FPM_MARKER="; Added by Vicarius CVE-2026-109618 workaround (GHSA advisory)" # Settings of the advisory workaround: "=[@]". WORKAROUND_SETTINGS=("memory_limit=-1") # Where PHP web interfaces are looked for: "|". SAPI_GLOBS=("fpm|/usr/sbin/php-fpm*" "fpm|/usr/local/sbin/php-fpm*" "fpm|/opt/remi/php*/root/usr/sbin/php-fpm" "apache|/usr/lib/apache2/modules/libphp*.so" "apache|/usr/lib64/httpd/modules/libphp*.so" "apache|/usr/lib/httpd/modules/libphp*.so" "apache|/usr/local/apache2/modules/libphp*.so" "cgi|/usr/bin/php-cgi*" "cgi|/usr/local/bin/php-cgi*" "cgi|/opt/remi/php*/root/usr/bin/php-cgi" "lsapi|/usr/local/lsws/lsphp*/bin/lsphp" "lsapi|/usr/bin/lsphp*" "frankenphp|/usr/local/bin/frankenphp" "frankenphp|/usr/bin/frankenphp") APACHE_CONF_GLOBS=("/etc/apache2/apache2.conf" "/etc/apache2/ports.conf" "/etc/apache2/conf-enabled/*.conf" "/etc/apache2/mods-enabled/*.conf" "/etc/apache2/mods-enabled/*.load" "/etc/apache2/sites-enabled/*" "/etc/httpd/conf/httpd.conf" "/etc/httpd/conf.d/*.conf" "/etc/httpd/conf.modules.d/*.conf") log() { printf '[%s] %s\n' "$(date '+%Y-%m-%d %H:%M:%S')" "$*"; } # Verdict: TRUE = mitigated (or not exposed), FALSE = still exposed. Exit 0: the script ran as intended. finish() { printf 'RESULT=%s|MITIGATED|%s\n' "$CVE_ID" "$1" exit 0 } # Real error (invalid configuration, unexpected failure): FALSE and exit 1 (cve-scripts.md). fail_error() { log "ERROR: $*" printf 'RESULT=%s|MITIGATED|FALSE\n' "$CVE_ID" exit 1 } run_bounded() { timeout "$COMMAND_TIMEOUT" "$@"; } # 0 if version $1 >= $2 (dotted numbers). ver_ge() { [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n 1)" = "$2" ]; } # Upstream part of a Debian version: no epoch, no revision. deb_upstream() { local v="${1#*:}"; printf '%s\n' "${v%-*}"; } discover_sapis() { # Prints "|" once per PHP web interface installed. local entry sapi pattern f real local -A seen=() shopt -s nullglob for entry in "${SAPI_GLOBS[@]}"; do sapi=${entry%%|*}; pattern=${entry#*|} # shellcheck disable=SC2206 # the glob must expand here local matches=($pattern) for f in "${matches[@]}"; do [ -f "$f" ] || continue case "$f" in *.dpkg-*|*.rpmnew|*.rpmsave|*.bak) continue ;; esac real=$(readlink -f -- "$f") || continue [ -n "${seen[$real]:-}" ] && continue seen[$real]=1 printf '%s|%s\n' "$sapi" "$real" done done shopt -u nullglob } php_version_of() { # The version compiled into the binary ("X-Powered-By: PHP/"). grep -aoE -m 1 'X-Powered-By: PHP/[0-9]+\.[0-9]+\.[0-9]+' -- "$1" 2>/dev/null | head -n 1 | sed 's#.*/##' } upstream_fixed() { # 0 if the upstream version already contains the fix. local v="$1" branch fixed branch=$(printf '%s\n' "$v" | cut -d. -f1,2) if ver_ge "$branch" "$LAST_AFFECTED_BRANCH" && [ "$branch" != "$LAST_AFFECTED_BRANCH" ]; then return 0; fi for fixed in "${FIXED_UPSTREAM[@]}"; do [ "$(printf '%s\n' "$fixed" | cut -d. -f1,2)" = "$branch" ] || continue ver_ge "$v" "$fixed" && return 0 done return 1 } package_fixed() { # 0 if the distribution package that owns file $1 has the fix backported. Prints the package used. local path="$1" pkg ver src entry name fixed rel if command -v dpkg-query >/dev/null 2>&1 && pkg=$(dpkg -S -- "$path" 2>/dev/null | head -n 1 | sed 's/: .*//; s/:.*//') && [ -n "$pkg" ]; then IFS='|' read -r ver src < <(dpkg-query -W -f='${Version}|${source:Package}\n' "$pkg" 2>/dev/null) printf '%s %s\n' "$pkg" "$ver" [ -n "${ver:-}" ] || return 1 for entry in "${DEB_FIXED[@]}"; do name=${entry%% *}; fixed=${entry#* } [ "$name" = "$src" ] || continue [ "$(deb_upstream "$ver")" = "$(deb_upstream "$fixed")" ] || continue dpkg --compare-versions "$ver" ge "$fixed" && return 0 done if [ -f "/usr/share/doc/$pkg/changelog.Debian.gz" ] && zgrep -q -- "$CHANGELOG_PATTERN" "/usr/share/doc/$pkg/changelog.Debian.gz" 2>/dev/null; then return 0 fi return 1 fi if command -v rpm >/dev/null 2>&1 && pkg=$(rpm -qf --qf '%{NAME} %{VERSION}-%{RELEASE} %{SOURCERPM}\n' -- "$path" 2>/dev/null | head -n 1) && [ -n "$pkg" ] && [[ "$pkg" != *"not owned"* ]]; then read -r name ver src <<<"$pkg" printf '%s %s\n' "$name" "$ver" # Source package name: the source rpm without "--.src.rpm". name=${src%-"$ver".src.rpm} for entry in "${RPM_FIXED[@]}"; do [ "${entry%% *}" = "$name" ] || continue fixed=${entry#* } [ "${fixed%%-*}" = "${ver%%-*}" ] || continue rel=$(rpm --eval "%{lua: print(rpm.vercmp('$ver', '$fixed'))}" 2>/dev/null) [ "${rel:-}" = 0 ] || [ "${rel:-}" = 1 ] && return 0 done # grep -c reads everything: with pipefail, grep -q could stop early and fail the pipeline (SIGPIPE). [ "$(run_bounded rpm -qf --changelog -- "$path" 2>/dev/null | grep -c -- "$CHANGELOG_PATTERN")" -gt 0 ] && return 0 return 1 fi printf '%s\n' "not owned by a package" return 1 } process_running() { # 0 if a process runs the executable $1. local exe p for p in /proc/[0-9]*; do exe=$(readlink "$p/exe" 2>/dev/null) || continue exe=${exe% (deleted)} [ "$exe" = "$1" ] && return 0 done return 1 } unit_uses() { # Prints enabled or active systemd services whose ExecStart runs $1. command -v systemctl >/dev/null 2>&1 || return 0 local u exec while read -r u _; do [ -n "$u" ] || continue exec=$(run_bounded systemctl show -p ExecStart --value "$u" 2>/dev/null) case "$exec" in *"$1 "*|*"$1;"*|*"path=$1 "*) ;; *) continue ;; esac if [ "$(run_bounded systemctl is-enabled "$u" 2>/dev/null)" = enabled ] || run_bounded systemctl is-active --quiet "$u" 2>/dev/null; then printf '%s\n' "$u" fi done < <(run_bounded systemctl list-unit-files --type=service --no-legend --no-pager '*php*' '*fpm*' '*lsws*' '*litespeed*' '*frankenphp*' '*caddy*' 2>/dev/null) } apache_conf_files() { local g f shopt -s nullglob for g in "${APACHE_CONF_GLOBS[@]}"; do # shellcheck disable=SC2206 # the glob must expand here local matches=($g) for f in "${matches[@]}"; do [ -f "$f" ] && printf '%s\n' "$f"; done done shopt -u nullglob } apache_active() { # 0 if Apache loads module $1 and Apache is running or enabled. local mod="$1" base u base=$(basename -- "$mod") [ -n "$(apache_conf_files | xargs -r grep -hsE "^[[:space:]]*LoadModule[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]*${base//./\\.}[[:space:]]*$")" ] || return 1 process_running "$(command -v apache2 2>/dev/null || echo /usr/sbin/apache2)" && return 0 process_running "$(command -v httpd 2>/dev/null || echo /usr/sbin/httpd)" && return 0 command -v systemctl >/dev/null 2>&1 || return 1 for u in apache2 httpd; do [ "$(run_bounded systemctl is-enabled "$u" 2>/dev/null)" = enabled ] && return 0 run_bounded systemctl is-active --quiet "$u" 2>/dev/null && return 0 done return 1 } sapi_active() { # 0 if the interface is in use. Prints why. local sapi="$1" path="$2" units if [ "$sapi" = apache ]; then apache_active "$path" && { echo "module loaded by Apache"; return 0; } echo "module not loaded by an enabled or running Apache"; return 1 fi process_running "$path" && { echo "running process"; return 0; } units=$(unit_uses "$path" | tr '\n' ' ') [ -n "$units" ] && { echo "service ${units% }"; return 0; } echo "not running and no enabled service"; return 1 } settings_for_branch() { # Prints " " for the workaround settings that apply to PHP branch $1. local s key val min for s in "${WORKAROUND_SETTINGS[@]}"; do key=${s%%=*}; val=${s#*=}; min="" case "$val" in *@*) min=${val#*@}; val=${val%@*} ;; esac [ -n "$min" ] && ! ver_ge "$1" "$min" && continue printf '%s %s\n' "$key" "$val" done } same_ini_value() { # Flags may be shown as 0/off/Off or 1/on/On. local a b a=$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]'); b=$(printf '%s' "$2" | tr '[:upper:]' '[:lower:]') case "$a" in off|false|no) a=0 ;; on|true|yes) a=1 ;; esac case "$b" in off|false|no) b=0 ;; on|true|yes) b=1 ;; esac [ "$a" = "$b" ] } fpm_workaround() { # 0 if every pool of PHP-FPM $1 enforces the settings with php_admin_value. 2 on error. Prints details. local bin="$1" branch="$2" dump pools key val pool got missing="" dump=$(run_bounded "$bin" -tt 2>&1) || { echo "php-fpm -tt failed: $(printf '%s' "$dump" | tail -n 1)"; return 2; } dump=$(printf '%s\n' "$dump" | sed -E 's/^\[[^]]*\] NOTICE:[[:space:]]*//') pools=$(printf '%s\n' "$dump" | grep -E '^\[[^]]+\]$' | tr -d '[]' | grep -vx global) [ -n "$pools" ] || { echo "no pools found in php-fpm -tt"; return 2; } while read -r key val; do [ -n "$key" ] || continue while read -r pool; do got=$(printf '%s\n' "$dump" | awk -v p="$pool" -v k="php_admin_value[$key]" ' /^\[[^]]+\]$/ { cur = substr($0, 2, length($0) - 2); next } cur == p && index($0, k) == 1 { v = $0; sub(/^[^=]*=[ \t]*/, "", v); print v; exit }') same_ini_value "${got:-}" "$val" || missing="$missing $pool:$key=${got:-unset}" done <<<"$pools" done < <(settings_for_branch "$branch") if [ -n "$missing" ]; then echo "pools without the enforced setting:$missing"; return 1; fi echo "all pools enforce: $(settings_for_branch "$branch" | tr '\n' ' ')" return 0 } apache_workaround() { # 0 if Apache enforces the settings with php_admin_value/php_admin_flag and nothing sets another value. local branch="$1" key val lines bad="" ok_all=true admin_ok d got while read -r key val; do [ -n "$key" ] || continue lines=$(apache_conf_files | xargs -r grep -hsE "^[[:space:]]*php_(admin_)?(value|flag)[[:space:]]+${key//./\\.}[[:space:]]" | awk '{print $1, $3}') admin_ok=false while read -r d got; do [ -n "${d:-}" ] || continue if same_ini_value "$got" "$val"; then case "$d" in php_admin_*) admin_ok=true ;; esac else bad="$bad $d $key $got;" fi done <<<"$lines" [ "$admin_ok" = true ] || ok_all=false done < <(settings_for_branch "$branch") if [ -n "$bad" ]; then echo "conflicting Apache directives:$bad"; return 1; fi [ "$ok_all" = true ] || { echo "Apache does not enforce the workaround with php_admin_value"; return 1; } echo "Apache enforces: $(settings_for_branch "$branch" | tr '\n' ' ')" return 0 } add_rollback() { printf '%s\n' "$*" >> "$ROLLBACK"; } backup_file() { # Copies $1 into this run's backup folder and records how to restore it. local src="$1" dest mkdir -p -- "$BACKUP_DIR" || return 1 dest="$BACKUP_DIR/$(printf '%s' "$src" | tr '/' '_')" [ -e "$dest" ] && return 0 cp -p -- "$src" "$dest" || return 1 add_rollback "cp -p -- '$dest' '$src'" log "Backup: $src -> $dest" } restore_file() { local src="$1" dest dest="$BACKUP_DIR/$(printf '%s' "$src" | tr '/' '_')" [ -f "$dest" ] && cp -p -- "$dest" "$src" } fpm_pool_files() { # Prints the PHP-FPM configuration files of binary $1 that define pools (main file and includes). local bin="$1" main dir inc f main=$(run_bounded "$bin" -tt 2>&1 | sed -nE 's/.*configuration file (.*) test is successful.*/\1/p' | tail -n 1) [ -f "$main" ] || return 1 dir=$(dirname -- "$main") { printf '%s\n' "$main" shopt -s nullglob while read -r inc; do case "$inc" in /*) ;; *) inc="$dir/$inc" ;; esac # shellcheck disable=SC2206 # the include glob must expand here local matches=($inc) for f in "${matches[@]}"; do [ -f "$f" ] && printf '%s\n' "$f"; done done < <(sed -nE 's/^[[:space:]]*include[[:space:]]*=[[:space:]]*"?([^";]*)"?[[:space:]]*$/\1/p' "$main") shopt -u nullglob } | while read -r f; do # Only files that define at least one pool (any section other than [global]). [ -n "$(grep -E '^[[:space:]]*\[[^]]+\][[:space:]]*$' "$f" | tr -d '[] \t' | grep -vx global)" ] && printf '%s\n' "$f" done } fpm_rewrite() { # Writes to stdout file $1 with the settings ("k=v;k=v" in $2) enforced right after every pool header. # Other definitions of the same keys are commented out. Running it again gives the same file. awk -v settings="$2" -v marker="$FPM_MARKER" -v note="; disabled by Vicarius $CVE_ID workaround" ' BEGIN { n = split(settings, s, ";") for (i = 1; i <= n; i++) { eq = index(s[i], "="); key[i] = substr(s[i], 1, eq - 1); val[i] = substr(s[i], eq + 1) ours[i] = "php_admin_value[" key[i] "] = " val[i] k = key[i]; gsub(/\./, "\\.", k); re[i] = "^[ \t]*php_(admin_)?(value|flag)\\[" k "\\]" } } $0 == marker { next } { for (i = 1; i <= n; i++) if ($0 == ours[i]) next if ($0 ~ /^[ \t]*\[[^]]+\][ \t]*$/) { name = $0; gsub(/[ \t\[\]]/, "", name); print if (name != "global") { print marker; for (i = 1; i <= n; i++) print ours[i] } next } for (i = 1; i <= n; i++) if ($0 ~ re[i]) { print "; " $0 " " note; next } print }' "$1" } reload_fpm() { # Graceful reload of PHP-FPM $1 so that every worker picks up the change. local bin="$1" u reloaded=false p exe while read -r u; do [ -n "$u" ] || continue if run_bounded systemctl is-active --quiet "$u" 2>/dev/null; then run_bounded systemctl reload "$u" || { log "Reload of $u failed."; return 1; } log "Reloaded service $u."; reloaded=true fi done < <(unit_uses "$bin") [ "$reloaded" = true ] && return 0 for p in /proc/[0-9]*; do exe=$(readlink "$p/exe" 2>/dev/null) || continue [ "${exe% (deleted)}" = "$bin" ] || continue case "$(tr '\0' ' ' < "$p/cmdline" 2>/dev/null)" in *"master process"*) ;; *) continue ;; esac kill -USR2 "${p#/proc/}" || { log "Could not signal PHP-FPM master ${p#/proc/}."; return 1; } log "Sent graceful reload (USR2) to PHP-FPM master ${p#/proc/}."; return 0 done log "PHP-FPM $bin is not running: the change applies when it starts." return 0 } apply_fpm() { local bin="$1" branch="$2" settings files f tmp settings=$(settings_for_branch "$branch" | awk '{printf "%s%s=%s", (NR > 1 ? ";" : ""), $1, $2}') mapfile -t files < <(fpm_pool_files "$bin") [ "${#files[@]}" -gt 0 ] || { log "[fpm] $bin: no pool configuration files found."; return 1; } for f in "${files[@]}"; do tmp=$(mktemp) || return 1 fpm_rewrite "$f" "$settings" > "$tmp" || { rm -f -- "$tmp"; return 1; } if cmp -s -- "$tmp" "$f"; then rm -f -- "$tmp"; continue; fi backup_file "$f" || { rm -f -- "$tmp"; log "Backup of $f failed: not changed."; return 1; } cat -- "$tmp" > "$f" || { rm -f -- "$tmp"; restore_file "$f"; return 1; } rm -f -- "$tmp" log "[fpm] Updated pools in $f: $settings" done if ! out=$(run_bounded "$bin" -t 2>&1); then log "[fpm] Configuration test failed, restoring: $(printf '%s' "$out" | tail -n 1)" for f in "${files[@]}"; do restore_file "$f"; done return 1 fi reload_fpm "$bin" } apache_ctl() { command -v apache2ctl 2>/dev/null || command -v apachectl 2>/dev/null; } apply_apache() { local branch="$1" key val conflicts="" snippet="" link="" ctl existed=false mod u while read -r key val; do [ -n "$key" ] || continue conflicts="$conflicts$(apache_conf_files | grep -v "zz-vicarius-${CVE_ID,,}" | xargs -r grep -HsE "^[[:space:]]*php_(admin_)?(value|flag)[[:space:]]+${key//./\\.}[[:space:]]" | while IFS= read -r line; do got=$(printf '%s\n' "${line#*:}" | awk '{print $3}'); same_ini_value "$got" "$val" || printf ' %s;' "$line"; done)" done < <(settings_for_branch "$branch") if [ -n "$conflicts" ]; then log "[apache] Other Apache directives set a different value; review them manually:$conflicts" return 1 fi if [ -d /etc/apache2/conf-available ]; then snippet="/etc/apache2/conf-available/zz-vicarius-${CVE_ID,,}.conf"; link="/etc/apache2/conf-enabled/zz-vicarius-${CVE_ID,,}.conf" elif [ -d /etc/httpd/conf.d ]; then snippet="/etc/httpd/conf.d/zz-vicarius-${CVE_ID,,}.conf" else log "[apache] Unknown Apache layout (no /etc/apache2/conf-available or /etc/httpd/conf.d)."; return 1 fi if [ -f "$snippet" ]; then existed=true; backup_file "$snippet" || return 1; else add_rollback "rm -f -- '$snippet'"; fi { echo "# Added by Vicarius: $CVE_ID workaround (GHSA advisory). Delete this file${link:+ and $link} and reload Apache to revert." for mod in php_module php7_module php5_module; do echo "" settings_for_branch "$branch" | while read -r key val; do echo " php_admin_value $key $val"; done echo "" done } > "$snippet" || return 1 if [ -n "$link" ] && [ ! -e "$link" ]; then ln -s "../conf-available/$(basename -- "$snippet")" "$link" || return 1 add_rollback "rm -f -- '$link'" fi log "[apache] Wrote $snippet" ctl=$(apache_ctl) || { log "[apache] apachectl not found."; return 1; } if ! out=$(run_bounded "$ctl" -t 2>&1); then log "[apache] Configuration test failed, reverting: $(printf '%s' "$out" | tail -n 1)" if [ "$existed" = true ]; then restore_file "$snippet"; else rm -f -- "$snippet" "$link"; fi return 1 fi for u in apache2 httpd; do if command -v systemctl >/dev/null 2>&1 && run_bounded systemctl is-active --quiet "$u" 2>/dev/null; then run_bounded systemctl reload "$u" || { log "[apache] Reload of $u failed."; return 1; } log "[apache] Reloaded service $u."; return 0 fi done if process_running "$(command -v apache2 2>/dev/null || echo /usr/sbin/apache2)" || process_running "$(command -v httpd 2>/dev/null || echo /usr/sbin/httpd)"; then run_bounded "$ctl" -k graceful || { log "[apache] Graceful restart failed."; return 1; } log "[apache] Graceful restart done."; return 0 fi log "[apache] Apache is not running: the change applies when it starts." return 0 } evaluate_sapi() { # Prints one of: fixed | inactive | mitigated | exposed | error, after logging the reason. local sapi="$1" path="$2" version branch pkginfo why active detail wrc version=$(php_version_of "$path") [ -n "$version" ] || { log "[$sapi] $path: PHP version not readable." >&2; echo error; return; } branch=$(printf '%s\n' "$version" | cut -d. -f1,2) if upstream_fixed "$version"; then log "[$sapi] $path: PHP $version contains the fix." >&2; echo fixed; return; fi if pkginfo=$(package_fixed "$path"); then log "[$sapi] $path: PHP $version, package $pkginfo has the fix backported." >&2; echo fixed; return; fi log "[$sapi] $path: PHP $version is affected (package: $pkginfo)." >&2 why=$(sapi_active "$sapi" "$path"); active=$? if [ "$active" -ne 0 ] && [ "$REQUIRE_ACTIVE_WEB_SAPI" = true ]; then log "[$sapi] $path: not in use ($why): not exposed." >&2; echo inactive; return fi [ "$active" -eq 0 ] && log "[$sapi] $path: in use ($why)." >&2 case "$sapi" in fpm) detail=$(fpm_workaround "$path" "$branch"); wrc=$? ;; apache) detail=$(apache_workaround "$branch"); wrc=$? ;; *) detail="no administrative workaround supported for $sapi"; wrc=1 ;; esac case "$wrc" in 0) log "[$sapi] $path: workaround in place ($detail)." >&2; echo mitigated ;; 2) log "[$sapi] $path: workaround could not be evaluated ($detail)." >&2; echo error ;; *) log "[$sapi] $path: workaround not in place ($detail)." >&2; echo "exposed $branch" ;; esac } log "Mitigating $CVE_ID on $(uname -srm) as $(id -un) (uid $(id -u)) | DRY_RUN=$DRY_RUN" # --- Validate configuration --- case "$DRY_RUN" in true|false) ;; *) fail_error "DRY_RUN must be true or false." ;; esac case "$REQUIRE_ACTIVE_WEB_SAPI" in true|false) ;; *) fail_error "REQUIRE_ACTIVE_WEB_SAPI must be true or false." ;; esac [[ "$COMMAND_TIMEOUT" =~ ^[1-9][0-9]*$ ]] || fail_error "Invalid COMMAND_TIMEOUT '$COMMAND_TIMEOUT'." case "$STATE_ROOT" in /?*) ;; *) fail_error "STATE_ROOT must be an absolute path: '$STATE_ROOT'." ;; esac [ "$(id -u)" -eq 0 ] || fail_error "Root privileges are required." # --- Exposure before any change --- mapfile -t sapis < <(discover_sapis) if [ "${#sapis[@]}" -eq 0 ]; then log "No PHP web server interface installed: not exposed, no changes needed." finish TRUE fi targets=(); errors=0 for s in "${sapis[@]}"; do state=$(evaluate_sapi "${s%%|*}" "${s#*|}") case "$state" in exposed*) targets+=("$s|${state#exposed }") ;; error) errors=$((errors + 1)) ;; esac done if [ "${#targets[@]}" -eq 0 ]; then [ "$errors" -gt 0 ] && fail_error "$errors PHP interface(s) could not be evaluated." log "No exposed PHP web interface: no changes needed. Updating PHP remains the complete fix." finish TRUE fi log "Exposed PHP web interfaces: ${#targets[@]}." if [ "$DRY_RUN" = true ]; then for t in "${targets[@]}"; do IFS='|' read -r sapi path branch <<<"$t" log "DRY-RUN: would enforce $(settings_for_branch "$branch" | tr '\n' ' ')on [$sapi] $path." done log "DRY-RUN: no changes made." finish FALSE fi # --- Apply --- { mkdir -p -- "$STATE_ROOT" && chmod 0700 -- "$STATE_ROOT"; } || fail_error "Could not create $STATE_ROOT." RUN_ID=$(date '+%Y%m%d%H%M%S') BACKUP_DIR="$STATE_ROOT/backup-$RUN_ID" ROLLBACK="$STATE_ROOT/rollback-$RUN_ID.sh" printf '#!/bin/sh\n# Reverts the %s workaround applied on %s. Reload PHP-FPM and Apache afterwards.\n' "$CVE_ID" "$RUN_ID" > "$ROLLBACK" || fail_error "Could not write $ROLLBACK." chmod 0700 "$ROLLBACK" failed=0; apache_done=false for t in "${targets[@]}"; do IFS='|' read -r sapi path branch <<<"$t" case "$sapi" in fpm) apply_fpm "$path" "$branch" || { failed=$((failed + 1)); log "[fpm] $path: workaround not applied."; } ;; apache) if [ "$apache_done" = false ]; then apply_apache "$branch" || { failed=$((failed + 1)); log "[apache] $path: workaround not applied."; } apache_done=true fi ;; *) failed=$((failed + 1)); log "[$sapi] $path: no supported administrative workaround; update PHP or mitigate manually (see README)." ;; esac done log "Rollback script: $ROLLBACK" # --- Verify the effective state --- still=0 for t in "${targets[@]}"; do IFS='|' read -r sapi path branch <<<"$t" state=$(evaluate_sapi "$sapi" "$path") case "$state" in mitigated|fixed|inactive) ;; *) still=$((still + 1)) ;; esac done log "Summary: exposed_before=${#targets[@]} apply_failures=$failed still_exposed=$still" if [ "$failed" -eq 0 ] && [ "$still" -eq 0 ]; then log "Workaround applied and verified. Mitigated, not patched: update PHP to a fixed release." finish TRUE fi finish FALSE

Description