PT-2021-4560 · Php+10 · Php+10
Published
2021-10-21
·
Updated
2025-08-11
·
CVE-2021-21703
CVSS v3.1
7.8
High
| Vector | AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PHP versions 7.3.x through 7.3.31
PHP versions 7.4.x through 7.4.24
PHP versions 8.0.x through 8.0.11
Description
The issue is related to the PHP FPM SAPI component, where child worker processes can access and modify memory shared with the main process, potentially causing the root process to conduct invalid memory reads and writes. This can be exploited to escalate privileges from a local unprivileged user to the root user. The vulnerability is associated with errors in access control when running the PHP FPM process.
Recommendations
For PHP versions 7.3.x through 7.3.31, update to a version above 7.3.31.
For PHP versions 7.4.x through 7.4.24, update to a version above 7.4.24.
For PHP versions 8.0.x through 8.0.11, update to a version above 8.0.11.
As a temporary workaround, consider restricting access to the PHP FPM SAPI component until a patch is available.
Exploit
Fix
Improper Access Control
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Php
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu