CVE-2021-21703
CVE-2021-21703 · PHP-FPM memory access in root process leading to privilege escalation
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.
CVSS 7.8 · Élevée · EPSS 1,4% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
php
- Versions du logiciel
- ≥ 7.3.x, ≤ 7.3.31: Concernée (custom)
- ≥ 7.4.x, < 7.4.25: Concernée (custom)
- ≥ 8.0.X, < 8.0.12: Concernée (custom)
Mettez à jour vers 7.4.25; Mettez à jour vers 8.0.12
php7.4 Debian:11
- Versions du logiciel
- 7.4.21-1+deb11u1
- Plages de versions concernées
- ECOSYSTEM: < 7.4.25-1+deb11u1
Mettez à jour vers 7.4.25-1+deb11u1
php5 Ubuntu:Pro:14.04:LTS
- Versions du logiciel
- 5.5.3+dfsg-1ubuntu2
- 5.5.3+dfsg-1ubuntu3
- 5.5.6+dfsg-1ubuntu1
- 5.5.6+dfsg-1ubuntu2
- 5.5.8+dfsg-2ubuntu1
- 5.5.9+dfsg-1ubuntu1
- 5.5.9+dfsg-1ubuntu2
- 5.5.9+dfsg-1ubuntu3
- 5.5.9+dfsg-1ubuntu4
- 5.5.9+dfsg-1ubuntu4.1
- 5.5.9+dfsg-1ubuntu4.2
- 5.5.9+dfsg-1ubuntu4.3
- 5.5.9+dfsg-1ubuntu4.4
- 5.5.9+dfsg-1ubuntu4.5
- 5.5.9+dfsg-1ubuntu4.6
- 5.5.9+dfsg-1ubuntu4.7
- 5.5.9+dfsg-1ubuntu4.9
- 5.5.9+dfsg-1ubuntu4.11
- 5.5.9+dfsg-1ubuntu4.12
- 5.5.9+dfsg-1ubuntu4.13
- 5.5.9+dfsg-1ubuntu4.14
- 5.5.9+dfsg-1ubuntu4.16
- 5.5.9+dfsg-1ubuntu4.17
- 5.5.9+dfsg-1ubuntu4.19
- 5.5.9+dfsg-1ubuntu4.20
- 5.5.9+dfsg-1ubuntu4.21
- 5.5.9+dfsg-1ubuntu4.22
- 5.5.9+dfsg-1ubuntu4.23
- 5.5.9+dfsg-1ubuntu4.24
- 5.5.9+dfsg-1ubuntu4.25
- 5.5.9+dfsg-1ubuntu4.26
- 5.5.9+dfsg-1ubuntu4.27
- 5.5.9+dfsg-1ubuntu4.29
- 5.5.9+dfsg-1ubuntu4.29+esm1
- 5.5.9+dfsg-1ubuntu4.29+esm2
- 5.5.9+dfsg-1ubuntu4.29+esm3
- 5.5.9+dfsg-1ubuntu4.29+esm4
- 5.5.9+dfsg-1ubuntu4.29+esm5
- 5.5.9+dfsg-1ubuntu4.29+esm6
- 5.5.9+dfsg-1ubuntu4.29+esm8
- 5.5.9+dfsg-1ubuntu4.29+esm10
- 5.5.9+dfsg-1ubuntu4.29+esm11
- 5.5.9+dfsg-1ubuntu4.29+esm12
- 5.5.9+dfsg-1ubuntu4.29+esm13
- 5.5.9+dfsg-1ubuntu4.29+esm14
- Plages de versions concernées
- ECOSYSTEM: < 5.5.9+dfsg-1ubuntu4.29+esm15
Mettez à jour vers 5.5.9+dfsg-1ubuntu4.29+esm15
php7.0 Ubuntu:Pro:16.04:LTS
- Versions du logiciel
- 7.0.1-5
- 7.0.1-6
- 7.0.2-1
- 7.0.2-3
- 7.0.2-4
- 7.0.2-5
- 7.0.3-2
- 7.0.3-3
- 7.0.3-9ubuntu1
- 7.0.4-5ubuntu1
- 7.0.4-5ubuntu2
- 7.0.4-7ubuntu1
- 7.0.4-7ubuntu2
- 7.0.4-7ubuntu2.1
- 7.0.8-0ubuntu0.16.04.1
- 7.0.8-0ubuntu0.16.04.2
- 7.0.8-0ubuntu0.16.04.3
- 7.0.13-0ubuntu0.16.04.1
- 7.0.15-0ubuntu0.16.04.1
- 7.0.15-0ubuntu0.16.04.2
- 7.0.15-0ubuntu0.16.04.4
- 7.0.18-0ubuntu0.16.04.1
- 7.0.22-0ubuntu0.16.04.1
- 7.0.25-0ubuntu0.16.04.1
- 7.0.28-0ubuntu0.16.04.1
- 7.0.30-0ubuntu0.16.04.1
- 7.0.32-0ubuntu0.16.04.1
- 7.0.33-0ubuntu0.16.04.1
- 7.0.33-0ubuntu0.16.04.2
- 7.0.33-0ubuntu0.16.04.3
- 7.0.33-0ubuntu0.16.04.4
- 7.0.33-0ubuntu0.16.04.5
- 7.0.33-0ubuntu0.16.04.6
- 7.0.33-0ubuntu0.16.04.7
- 7.0.33-0ubuntu0.16.04.9
- 7.0.33-0ubuntu0.16.04.11
- 7.0.33-0ubuntu0.16.04.12
- 7.0.33-0ubuntu0.16.04.14
- 7.0.33-0ubuntu0.16.04.15
- 7.0.33-0ubuntu0.16.04.16
- 7.0.33-0ubuntu0.16.04.16+esm1
- Plages de versions concernées
- ECOSYSTEM: < 7.0.33-0ubuntu0.16.04.16+esm2
Mettez à jour vers 7.0.33-0ubuntu0.16.04.16+esm2
php7.2 Ubuntu:18.04:LTS
- Versions du logiciel
- 7.2.1-1ubuntu2
- 7.2.2-1ubuntu1
- 7.2.2-1ubuntu2
- 7.2.3-1ubuntu1
- 7.2.5-0ubuntu0.18.04.1
- 7.2.7-0ubuntu0.18.04.1
- 7.2.7-0ubuntu0.18.04.2
- 7.2.10-0ubuntu0.18.04.1
- 7.2.15-0ubuntu0.18.04.1
- 7.2.15-0ubuntu0.18.04.2
- 7.2.17-0ubuntu0.18.04.1
- 7.2.19-0ubuntu0.18.04.1
- 7.2.19-0ubuntu0.18.04.2
- 7.2.24-0ubuntu0.18.04.1
- 7.2.24-0ubuntu0.18.04.2
- 7.2.24-0ubuntu0.18.04.3
- 7.2.24-0ubuntu0.18.04.4
- 7.2.24-0ubuntu0.18.04.6
- 7.2.24-0ubuntu0.18.04.7
- 7.2.24-0ubuntu0.18.04.8
- 7.2.24-0ubuntu0.18.04.9
- Plages de versions concernées
- ECOSYSTEM: < 7.2.24-0ubuntu0.18.04.10
Mettez à jour vers 7.2.24-0ubuntu0.18.04.10
php7.4 Ubuntu:20.04:LTS
- Versions du logiciel
- 7.4.3-4build1
- 7.4.3-4build2
- 7.4.3-4ubuntu1
- 7.4.3-4ubuntu1.1
- 7.4.3-4ubuntu2.2
- 7.4.3-4ubuntu2.4
- 7.4.3-4ubuntu2.5
- 7.4.3-4ubuntu2.6
- Plages de versions concernées
- ECOSYSTEM: < 7.4.3-4ubuntu2.7
Mettez à jour vers 7.4.3-4ubuntu2.7
Sources originales
- https://bugs.php.net/bug.php?id=81026
- https://www.debian.org/security/2021/dsa-4992
- https://www.debian.org/security/2021/dsa-4993
- http://www.openwall.com/lists/oss-security/2021/10/26/7
- https://lists.debian.org/debian-lts-announce/2021/10/msg00021.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JO5RA6YOBGGGKLIA6F6BQRZDDECF5L3R/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBM3KKB3RY2YPOKNMC4HIH7IH3T3WC74/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PZVLICZUJMXOGWOUWSBAEGIVTF6Y6V3/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://security.netapp.com/advisory/ntap-20211118-0003/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.gentoo.org/glsa/202209-20
- https://nvd.nist.gov/vuln/detail/CVE-2021-21703