CVE-2021-21703: PHP-FPM memory access in root process leading to privilege escalation

Vulnerability summary

CVE-2021-21703 is a high (CVSS 7.8) Improper Access Control vulnerability in debian debian_linux. EPSS estimates a 1.43% chance of exploitation in the next 30 days, higher than 72.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 25-10-2021
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.