CVE-2021-21703

HIGH

PHP 7.3.x<=7.3.31 7.4.x<7.4.25 8.0.x<8.0.12 - Privilege Escalation via FPM Shared Memory

Title source: llm
STIX 2.1

Description

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.

References (12)

Core 12
Core References
Exploit, Issue Tracking, Patch, Vendor Advisory x_refsource_misc
https://bugs.php.net/bug.php?id=81026
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2021/dsa-4992
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2021/dsa-4993
Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/10/26/7
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2021/10/msg00021.html
Patch, Vendor Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujan2022.html
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20211118-0003/
Patch, Vendor Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuapr2022.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202209-20

Scores

CVSS v3 7.8
EPSS 0.0013
EPSS Percentile 32.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Details

CWE
CWE-284 CWE-787
Status published
Products (9)
debian/debian_linux 9.0
debian/debian_linux 10.0
debian/debian_linux 11.0
fedoraproject/fedora 33
fedoraproject/fedora 34
fedoraproject/fedora 35
netapp/clustered_data_ontap
oracle/communications_diameter_signaling_router 8.0.0.0 - 8.5.0.2
php/php 7.3.0 - 7.3.31
Published Oct 25, 2021
Tracked Since Feb 18, 2026