AFAIU this is not about the size of the file but making the php process that runs a file surpass the configured limit (of RAM). At which point sometimes something goes wrong with letting go of that memory and then the second vulnerability allows using that limboed memory that not only shouldn’t be used but also can contain some internal values from the first one
xthexder@l.sw0.com 2 days ago
What confuses me as someone who hasn’t written PHP in ages, is why is it supposedly so easy for a request to hit the memory limit? Does this only work on servers that accept user uploads and other large request payloads? People are saying a static PHP page can be exploited, but I don’t understand how if it’s behind even a basic nginx instance with default request limit of 1MB.
INeedMana@piefed.zip 2 days ago
neclimdul@lemmy.world 1 day ago
yeah the uploadprogress and multipart are caused by php loading the request into memory and that going over the limit. thats the most straightforward and dangerous and one of the mitigations was limiting uplaod sizes. But they triggered it first using Wordpress to trigger the oom. And it sounds like there are ways to cause the form processing to bail without and oom and trigger a similar pointer reuse.
So the post/upload oom are maybe the most interesting but you can bet if people dont patch we’ll see more involved versions. and since php is hidden in things like routers and server management devices and… thats probably a safe bet.