CVE-2021-21703

Updated: 2022-10-28 23:29:16.169318

Description:

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.


Links NIST CIRCL RHEL Ubuntu

Severity

Severity Score
CVSS Version 2.x MEDIUM 6.9
CVSS Version 3.x HIGH 7

Status

OS name Project name Version Score Severity Status Errata Last updated
EL 6 PHP php 5.5 7 HIGH Released 2022-09-16 11:02:17
EL 6 PHP php 7.4 7 HIGH Not Vulnerable 2022-09-16 11:02:11
EL 6 PHP php 5.6 7 HIGH Released 2022-08-11 17:02:13
EL 6 PHP php 5.3 7 HIGH Released 2022-08-11 17:02:13
EL 6 PHP php 7.0 7 HIGH Released 2022-09-16 11:02:14
EL 6 PHP php 8.0 7 HIGH Not Vulnerable 2022-09-16 11:02:11
EL 6 PHP php 7.1 7 HIGH Released 2022-09-16 11:02:14
EL 6 PHP php 5.4 7 HIGH Released 2022-09-16 11:02:17
EL 6 PHP php 7.2 7 HIGH Released 2022-08-12 21:17:38
EL 6 PHP php 8.1 7 HIGH Not Vulnerable 2022-09-16 11:02:11
Total: 70