High CPU Consumption Vulnerability in PHP Packages: CVE-2015-9253
Summary
UBUNTU-CVE-2015-9253: An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. Affects php5 versions < 5.5.9+dfsg-1ubuntu4.29+esm10. Fixed in 5.5.9+dfsg-1ubuntu4.29+esm10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use and flexibility, allowing developers to create dynamic web pages and applications. The vulnerability CVE-2015-9253 affects multiple versions of PHP packages, including php5, php7.0, and php7.2, which are critical for running PHP applications on Ubuntu systems. This vulnerability can lead to significant performance issues, including high CPU usage and excessive disk space consumption due to error logging.
Vulnerability Detail
An issue was discovered in PHP versions 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process can restart a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream. This behavior can cause the master process to consume 100% of the CPU and generate a large volume of error logs, leading to potential denial of service conditions.
How To Fix
Minimum fixed version
5.5.9+dfsg-1ubuntu4.29+esm10
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider disabling the php-fpm service temporarily or configuring it to limit the number of child processes to mitigate CPU usage. You can do this by editing the php-fpm configuration file (usually located at /etc/php/7.x/fpm/pool.d/www.conf) and setting 'pm.max_children' to a lower value.
Conclusion
CVE-2015-9253 is a significant vulnerability affecting multiple PHP versions that can lead to high CPU consumption and denial of service. It is crucial for users to update their PHP packages to the latest patched versions and consider using monitoring tools like Vulert to stay informed about vulnerabilities in their software.
See every vulnerability recorded for php5 →
FAQ
CVE-2015-9253 is a vulnerability in PHP that can lead to high CPU usage and excessive logging due to an endless loop in the php-fpm process.
The vulnerability affects PHP versions 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and 7.1.20 and earlier.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to denial of service, as the php-fpm master process may consume excessive CPU resources and generate large error logs.
Regularly update your PHP packages and monitor for vulnerabilities using tools like Vulert to ensure your applications are secure.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
