← Back

CVE-2021-21703

nvd nist
Published: Oct 25, 2021Modified: Jun 17, 2026

JSON object

Loading...
7.0
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.0 / Impact: 5.9
Source: NVD

Description

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.

Affected (11)

Products: Php: Php · Debian: Debian Linux · Fedoraproject: Fedora · +2 more
Show all products
1 product
Php
1 product
Debian Linux
1 product
Fedora
1 product
Clustered Data Ontap
1 product
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Php
From 7.3.0 to 7.3.31
From 7.4.0 to 7.4.25
From 8.0.0 to 8.0.12
Configuration B
3 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Version 10.0
Version 11.0
Version 9.0
Configuration C
3 vulnerable
Vulnerable SoftwareAffected Versions
Fedoraproject
Version 33
Version 34
Version 35
Configuration D
1 vulnerable
Vulnerable SoftwareAffected Versions
All versions
Configuration E
1 vulnerable
Vulnerable SoftwareAffected Versions
From 8.0.0.0 to 8.5.0.2

References (24)

Source: security@php.net
Mailing ListPatchThird Party Advisory
Source: security@php.net
ExploitIssue TrackingPatchVendor Advisory
Source: security@php.net
Mailing ListThird Party Advisory
Source: security@php.net
Third Party Advisory
Source: security@php.net
Third Party Advisory
Source: security@php.net
Third Party Advisory
Source: security@php.net
Third Party Advisory
Source: security@php.net
PatchVendor Advisory
Source: security@php.net
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingPatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory

Timeline

No history available yet.