CVE-2021-21703

EUVD-2021-8875
In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
phpCNA
7.8 HIGH
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 32%
Affected Products (NVD)
VendorProductVersion
phpphp
7.3.0 ≤
𝑥
≤ 7.3.31
phpphp
7.4.0 ≤
𝑥
< 7.4.25
phpphp
8.0.0 ≤
𝑥
< 8.0.12
debiandebian_linux
9.0
debiandebian_linux
10.0
debiandebian_linux
11.0
netappclustered_data_ontap
-
oraclecommunications_diameter_signaling_router
8.0.0.0 ≤
𝑥
≤ 8.5.0.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
php7.4
bullseye
7.4.33-1+deb11u5
fixed
bullseye (security)
7.4.33-1+deb11u6
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php5
bionic
dne
focal
dne
hirsute
dne
impish
dne
jammy
dne
trusty
Fixed 5.5.9+dfsg-1ubuntu4.29+esm15
released
xenial
dne
php7.0
bionic
dne
focal
dne
hirsute
dne
impish
dne
jammy
dne
trusty
dne
xenial
Fixed 7.0.33-0ubuntu0.16.04.16+esm2
released
php7.2
bionic
Fixed 7.2.24-0ubuntu0.18.04.10
released
focal
dne
hirsute
dne
impish
dne
jammy
dne
trusty
dne
xenial
dne
php7.4
bionic
dne
focal
Fixed 7.4.3-4ubuntu2.7
released
hirsute
Fixed 7.4.16-1ubuntu2.2
released
impish
dne
jammy
dne
trusty
dne
xenial
dne
php8.0
bionic
dne
focal
dne
hirsute
dne
impish
Fixed 8.0.8-1ubuntu0.1
released
jammy
dne
trusty
dne
xenial
dne
php8.1
bionic
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
not-affected
trusty
dne
xenial
dne
References