Skip to content

Commit 63576f2

Browse files
devploitdevploit
committed
Verify every PR-added RCE profile on the amd64 mirror images
8.5.0-8.5.4, 8.5.6-8.5.8 and 8.5.10 were reproduced with uid=33(www-data) via the public mirror.gcr.io images after Docker Hub rate-limited the direct pulls. Remove the contributor-reported markers and update the evidence, matrix report and inventory.
1 parent 01fb3d6 commit 63576f2

13 files changed

Lines changed: 92 additions & 29 deletions

‎README.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -70,11 +70,12 @@ not match the profile.
7070
rows covering 39 distinct PHP builds.**
7171

7272
Independent re-verification on 2026-10-30 reproduced the command proof
73-
(`uid=33(www-data)`) for 8.4.10, 8.4.11, 8.4.19, 8.4.20, 8.4.25, 8.5.5,
74-
8.5.9 and 8.5.11; the details are in
73+
(`uid=33(www-data)`) for every RCE profile added by this branch: 8.4.10,
74+
8.4.11, 8.4.19, 8.4.20, 8.4.25 amd64 and all of 8.5.0–8.5.10 amd64 plus
75+
8.5.11 aarch64. The details are in
7576
[the verification log](docs/calibration-logs/verified-2026-10-30.md). The
76-
remaining RCE profiles are contributor-reported until they are re-run (Docker
77-
Hub's pull limit blocked the additional images during that review).
77+
four profiles that already existed on `main` were verified before this branch
78+
and were not re-run during this review.
7879

7980
`Heap leak` is stage 1, `libphp leak` is stage 2 and `RCE` is a real command
8081
proof on an isolated lab. `no` means not verified, not necessarily impossible;

‎docs/calibration-logs/matrix_report.json‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,18 +35,72 @@
3535
"rce": true,
3636
"profile": "profiles/8.4.25-bookworm-amd64.json"
3737
},
38+
{
39+
"label": "8.5.0-bookworm-amd64",
40+
"status": "rce",
41+
"rce": true,
42+
"profile": "profiles/8.5.0-bookworm-amd64.json"
43+
},
44+
{
45+
"label": "8.5.1-bookworm-amd64",
46+
"status": "rce",
47+
"rce": true,
48+
"profile": "profiles/8.5.1-bookworm-amd64.json"
49+
},
50+
{
51+
"label": "8.5.2-bookworm-amd64",
52+
"status": "rce",
53+
"rce": true,
54+
"profile": "profiles/8.5.2-bookworm-amd64.json"
55+
},
56+
{
57+
"label": "8.5.3-bookworm-amd64",
58+
"status": "rce",
59+
"rce": true,
60+
"profile": "profiles/8.5.3-bookworm-amd64.json"
61+
},
62+
{
63+
"label": "8.5.4-bookworm-amd64",
64+
"status": "rce",
65+
"rce": true,
66+
"profile": "profiles/8.5.4-bookworm-amd64.json"
67+
},
3868
{
3969
"label": "8.5.5-bookworm-amd64",
4070
"status": "rce",
4171
"rce": true,
4272
"profile": "profiles/8.5.5-bookworm-amd64.json"
4373
},
74+
{
75+
"label": "8.5.6-bookworm-amd64",
76+
"status": "rce",
77+
"rce": true,
78+
"profile": "profiles/8.5.6-bookworm-amd64.json"
79+
},
80+
{
81+
"label": "8.5.7-bookworm-amd64",
82+
"status": "rce",
83+
"rce": true,
84+
"profile": "profiles/8.5.7-bookworm-amd64.json"
85+
},
86+
{
87+
"label": "8.5.8-bookworm-amd64",
88+
"status": "rce",
89+
"rce": true,
90+
"profile": "profiles/8.5.8-bookworm-amd64.json"
91+
},
4492
{
4593
"label": "8.5.9-bookworm-amd64",
4694
"status": "rce",
4795
"rce": true,
4896
"profile": "profiles/8.5.9-bookworm-amd64.json"
4997
},
98+
{
99+
"label": "8.5.10-bookworm-amd64",
100+
"status": "rce",
101+
"rce": true,
102+
"profile": "profiles/8.5.10-bookworm-amd64.json"
103+
},
50104
{
51105
"label": "8.5.11-bookworm-aarch64",
52106
"status": "rce",

‎docs/calibration-logs/verified-2026-10-30.md‎

Lines changed: 22 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
# Independent verification run — 2026-10-30
22

3-
These runs were made by the maintainer on the local, disposable labs only
3+
These runs were made by the maintainer on local, disposable labs only
44
(loopback), using the profiles and the dispatcher from this branch.
55

66
Environment: Docker Desktop on macOS arm64; official `php:<version>-apache`
77
images under `--platform linux/amd64` (except 8.5.11 aarch64), the lab
88
`php.ini`/`apache.conf` from `lab/rce/`, one prefork worker,
99
`display_errors=On`, `memory_limit=8M`, `post_max_size=512M`.
1010

11+
Docker Hub hit its unauthenticated pull limit during the review, so the later
12+
images were pulled from the public `mirror.gcr.io/library/php` mirror by the
13+
same amd64 manifest digests. That does not change the image contents.
14+
1115
Command shape:
1216

1317
```sh
@@ -28,16 +32,20 @@ Result: `PRE-AUTH RCE CONFIRMED` with `uid=33(www-data)`.
2832
| 8.4.19 amd64 | `php-8.4.19-bookworm-amd64` | `uid=33(www-data)` |
2933
| 8.4.20 amd64 | `php-8.4.20-bookworm-amd64` | `uid=33(www-data)` |
3034
| 8.4.25 amd64 | `php-8.4.25-bookworm-amd64` | `uid=33(www-data)` |
31-
| 8.5.5 amd64 | `php-8.5.5-bookworm-amd64` | `uid=33(www-data)` (vessel stage 3) |
32-
| 8.5.9 amd64 | `php-8.5.9-bookworm-amd64` | `uid=33(www-data)` (vessel stage 3) |
33-
| 8.5.11 aarch64 | `php-8.5.11-bookworm-aarch64` | `uid=33(www-data)` (carrier stage 3) |
34-
35-
The remaining RCE profiles in this PR (8.5.0–8.5.4, 8.5.6–8.5.8 and
36-
8.5.10 amd64) are still **contributor-reported**: Docker Hub's unauthenticated
37-
pull limit blocked the additional amd64 image pulls during this review. They
38-
are not demoted, but they should be independently re-run when the limit
39-
resets; the reproducible command is the one above.
40-
41-
The full command output for each run is kept in the maintainer's local
42-
verification log; the entries above are the ones reflected in
43-
`docs/calibration-logs/matrix_report.json`.
35+
| 8.5.0 amd64 | `php-8.5.0-bookworm-amd64` | `uid=33(www-data)` (vessel; retry after a garbage stage-1 leak) |
36+
| 8.5.1 amd64 | `php-8.5.1-bookworm-amd64` | `uid=33(www-data)` (vessel) |
37+
| 8.5.2 amd64 | `php-8.5.2-bookworm-amd64` | `uid=33(www-data)` (vessel) |
38+
| 8.5.3 amd64 | `php-8.5.3-bookworm-amd64` | `uid=33(www-data)` (vessel) |
39+
| 8.5.4 amd64 | `php-8.5.4-bookworm-amd64` | `uid=33(www-data)` (vessel) |
40+
| 8.5.5 amd64 | `php-8.5.5-bookworm-amd64` | `uid=33(www-data)` (vessel) |
41+
| 8.5.6 amd64 | `php-8.5.6-bookworm-amd64` | `uid=33(www-data)` (vessel) |
42+
| 8.5.7 amd64 | `php-8.5.7-bookworm-amd64` | `uid=33(www-data)` (vessel) |
43+
| 8.5.8 amd64 | `php-8.5.8-bookworm-amd64` | `uid=33(www-data)` (vessel) |
44+
| 8.5.9 amd64 | `php-8.5.9-bookworm-amd64` | `uid=33(www-data)` (vessel) |
45+
| 8.5.10 amd64 | `php-8.5.10-bookworm-amd64` | `uid=33(www-data)` (carrier) |
46+
| 8.5.11 aarch64 | `php-8.5.11-bookworm-aarch64` | `uid=33(www-data)` (carrier) |
47+
48+
This covers every RCE profile added by this PR. The four existing `main`
49+
profiles (8.4.26 amd64, 8.4.25 aarch64, 8.5.10 aarch64 and 8.5.11 amd64) were
50+
already marked verified before this branch and were not re-run during this
51+
session.

‎docs/profile-inventory.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,8 +73,8 @@ Generated from `profiles/*.json` by `tools/php2shell_inventory.py`.
7373
so S steers the dangling reference one page up onto B2's blob page and
7474
blob 1 embeds the reference pattern itself. The geometry calibrated on
7575
8.5.0/8.5.5 (under gdb and without it) was carried over to 8.5.1–8.5.9;
76-
the maintainer independently re-verified 8.5.5 and 8.5.9 on 2026-10-30,
77-
and the remaining early-8.5 rows are contributor-reported. Fixed in 8.5.12.
76+
the maintainer independently re-verified every early-8.5 row, 8.5.10 amd64
77+
and 8.5.11 aarch64 on 2026-10-30. Fixed in 8.5.12.
7878

7979
### Leaks reproduced, stage 3 misses
8080

‎profiles/8.5.0-bookworm-amd64.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,5 +50,5 @@
5050
"chunk_base": "0x7f6fc0800000",
5151
"libphp_base": "0x7f6fbd200000"
5252
},
53-
"status": "contributor-reported — RCE verified (vessel stage 3; uid=33 www-data proof)"
53+
"status": "RCE verified (vessel stage 3; uid=33 www-data proof)"
5454
}

‎profiles/8.5.1-bookworm-amd64.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,5 +50,5 @@
5050
"chunk_base": "0x7fa454800000",
5151
"libphp_base": "0x7fa456400000"
5252
},
53-
"status": "contributor-reported — RCE verified (vessel stage 3; uid=33 www-data proof)"
53+
"status": "RCE verified (vessel stage 3; uid=33 www-data proof)"
5454
}

‎profiles/8.5.10-bookworm-amd64.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,5 +59,5 @@
5959
"chunk_base": "0x7f5973400000",
6060
"libphp_base": "0x7f596fe00000"
6161
},
62-
"status": "contributor-reported — RCE verified"
62+
"status": "RCE verified"
6363
}

‎profiles/8.5.2-bookworm-amd64.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,5 +50,5 @@
5050
"chunk_base": "0x7f13bb000000",
5151
"libphp_base": "0x7f13bcc00000"
5252
},
53-
"status": "contributor-reported — RCE verified (vessel stage 3; uid=33 www-data proof)"
53+
"status": "RCE verified (vessel stage 3; uid=33 www-data proof)"
5454
}

‎profiles/8.5.3-bookworm-amd64.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,5 +50,5 @@
5050
"chunk_base": "0x7f5958c00000",
5151
"libphp_base": "0x7f5955400000"
5252
},
53-
"status": "contributor-reported — RCE verified (vessel stage 3; uid=33 www-data proof)"
53+
"status": "RCE verified (vessel stage 3; uid=33 www-data proof)"
5454
}

‎profiles/8.5.4-bookworm-amd64.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,5 +50,5 @@
5050
"chunk_base": "0x7f5bb5c00000",
5151
"libphp_base": "0x7f5bb2600000"
5252
},
53-
"status": "contributor-reported — RCE verified (vessel stage 3; uid=33 www-data proof)"
53+
"status": "RCE verified (vessel stage 3; uid=33 www-data proof)"
5454
}

0 commit comments

Comments
 (0)