Vulnerability · Published Oct 25, 2021 · Assigned by php
CVE-2021-21703PHP-FPM memory access in root process leading to privilege escalation
High 7.8
In plain English
A high-severity out-of-bounds write in PHP from PHP Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)1.4%top 26.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | apcu-panel | 5.1.18-1.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | libzip | 1.6.1-1.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | libzip-devel | 1.6.1-1.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | libzip-tools | 1.6.1-1.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-bcmath | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-cli | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-common | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-dba | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-dbg | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-devel | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-embedded | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-enchant | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-ffi | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-fpm | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-gd | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-gmp | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-intl | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-json | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-ldap | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-mbstring | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-mysqlnd | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-odbc | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-opcache | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-pdo | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-pear | 1:1.10.12-1.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-pecl-apcu | 5.1.18-1.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-pecl-apcu-devel | 5.1.18-1.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-pecl-rrd | 2.0.1-1.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-pecl-xdebug | 2.9.5-1.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-pecl-zip | 1.18.2-1.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-pgsql | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-process | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-snmp | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-soap | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-xml | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| AlmaLinux:8 | php-xmlrpc | 7.4.19-2.module_el8.6.0+2750+78feabcb | ALSA-2022:1935 |
| Rocky Linux:8 | libzip | 0:1.6.1-1.module+el8.6.0+789+2130c178 | RLSA-2022:1935 |
| Rocky Linux:8 | libzip | 0:1.6.1-1.module+el8.4.0+415+e936cba3 | RLSA-2022:1935 |
| Rocky Linux:8 | php | 0:7.4.19-2.module+el8.6.0+789+2130c178 | RLSA-2022:1935 |
| Rocky Linux:8 | php-pear | 1:1.10.12-1.module+el8.4.0+415+e936cba3 | RLSA-2022:1935 |
| Rocky Linux:8 | php-pear | 1:1.10.12-1.module+el8.6.0+789+2130c178 | RLSA-2022:1935 |
| Rocky Linux:8 | php-pecl-apcu | 0:5.1.18-1.module+el8.6.0+789+2130c178 | RLSA-2022:1935 |
| Rocky Linux:8 | php-pecl-apcu | 0:5.1.18-1.module+el8.4.0+415+e936cba3 | RLSA-2022:1935 |
| Rocky Linux:8 | php-pecl-rrd | 0:2.0.1-1.module+el8.4.0+414+2e7afcdd | RLSA-2022:1935 |
| Rocky Linux:8 | php-pecl-xdebug | 0:2.9.5-1.module+el8.4.0+415+e936cba3 | RLSA-2022:1935 |
| Rocky Linux:8 | php-pecl-zip | 0:1.18.2-1.module+el8.6.0+789+2130c178 | RLSA-2022:1935 |
| Rocky Linux:8 | php-pecl-zip | 0:1.18.2-1.module+el8.4.0+415+e936cba3 | RLSA-2022:1935 |
Affected products (as reported)
Weakness: CWE-787, CWE-284 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://bugs.php.net/bug.php?id=81026 x_refsource_MISC
- DSA-4992 vendor-advisory, x_refsource_DEBIAN
- DSA-4993 vendor-advisory, x_refsource_DEBIAN
- [oss-security] 20211026 CVE-2021-21703: PHP-FPM 5.3.7 <= 8.0.12 Local Root mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20211027 [SECURITY] [DLA 2794-1] php7.0 security update mailing-list, x_refsource_MLIST
- FEDORA-2021-9f68f5f752 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-4140b54de2 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-02d218c3be vendor-advisory, x_refsource_FEDORA
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20211118-0003/ x_refsource_CONFIRM
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- GLSA-202209-20 vendor-advisory, x_refsource_GENTOO