Vulnerability CVE-2021-21703


Published: 2021-10-25

Description:
In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.

Type:

CWE-787

CVSS2 => (AV:L/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.2/10
10/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
PHP -> PHP 
Debian -> Debian linux 

 References:
https://bugs.php.net/bug.php?id=81026
https://www.debian.org/security/2021/dsa-4993
https://www.debian.org/security/2021/dsa-4992
http://www.openwall.com/lists/oss-security/2021/10/26/7
https://lists.debian.org/debian-lts-announce/2021/10/msg00021.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBM3KKB3RY2YPOKNMC4HIH7IH3T3WC74/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JO5RA6YOBGGGKLIA6F6BQRZDDECF5L3R/

Copyright 2021, cxsecurity.com

 

Back to Top