Skip to content

php-zts 8.4.25-1 Debian package crashes with SIGILL on Argon2; 8.4.24-1 works #2684

Closed

Description

@zoltan65

What happened?
The Debian php-zts packages from pkg.henderkes.com version 8.4.25-1 reproducibly crash with SIGILL when using Argon2 password hashing.
Minimal reproducer:
php-zts -r '
$h = password_hash("test123", PASSWORD_ARGON2ID);
var_dump($h);
var_dump(password_verify("test123", $h));
'

With php-zts-cli 8.4.25-1:
Illegal instruction

Bcrypt works correctly:
php-zts -r '
var_dump(password_hash("test123", PASSWORD_BCRYPT));
var_dump(password_verify("test123", password_hash("test123", PASSWORD_BCRYPT)));
'

Result:
string(60) "$2y$..."
bool(true)

The regular Debian PHP 8.4 NTS build also handles Argon2id correctly.
Downgrading only:
php-zts-cli 8.4.25-1 -> 8.4.24-1
php-zts-embed 8.4.25-1 -> 8.4.24-1

fixes the issue immediately.
With 8.4.24-1 the same Argon2id reproducer returns:
string(97) "$argon2id$..."
bool(true)

This also affected FrankenPHP 1.12.7 serving Nextcloud 35.0.1. Authentication caused the FrankenPHP process to terminate with SIGILL. After downgrading php-zts CLI/embed to 8.4.24-1, Nextcloud authentication works.
Backtrace
A coredump from the FrankenPHP crash shows:
#5 decode_string
#6 argon2_verify
#7 ...
#8 ...
#9 execute_ex
#10 zend_execute
#11 zend_execute_script
#12 php_execute_script_ex

Environment
OS: Debian 13 (trixie)
Architecture: amd64
FrankenPHP: 1.12.7+php84-1
php-zts-cli broken: 8.4.25-1
php-zts-embed broken: 8.4.25-1
php-zts-cli working: 8.4.24-1
php-zts-embed working: 8.4.24-1
Repository:
https://pkg.henderkes.com/api/packages/84/debian

The VM was also tested with a host CPU exposing AVX/AVX2 and the crash still occurred, so this does not appear to be caused by the VM exposing an insufficient CPU feature set.
PASSWORD_ARGON2_PROVIDER reports:
string(8) "standard"

for both Debian PHP NTS and php-zts.
Package versions
frankenphp 1.12.7+php84-1
php-zts-cli 8.4.25-1
php-zts-embed 8.4.25-1

Could there be a regression in the Argon2 build/configuration in the 8.4.25-1 php-zts packages?

root@NextCloud:# apt-cache policy php-zts-cli php-zts-embed
php-zts-cli:
Installed: 8.4.24-1
Candidate: 8.4.25-1
Version table:
8.4.25-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
*** 8.4.24-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
100 /var/lib/dpkg/status
8.4.23-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.22-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.21-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.20-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.19-2 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.19-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.18-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.17-2 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.17-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.16-7 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.16-6 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.16-3 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.16-2 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.16-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
php-zts-embed:
Installed: 8.4.24-1
Candidate: 8.4.25-1
Version table:
8.4.25-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
*** 8.4.24-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
100 /var/lib/dpkg/status
8.4.23-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.22-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.20-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.19-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.18-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.17-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.16-7 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.16-6 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.16-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
root@NextCloud:
#

Activity

  1. henderkes commented on Oct 4, 2026

    @henderkes
    Contributor

    There are avx512 instructions in the new ones, but I haven't changed anything since 8.4.24-1 afaik. Maybe a gcc update from 16.1 to 16.2. Perhaps github runner hardware changed? Will investigate where that's coming from.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions