CVE-2021-21703

Name of the Vulnerable Software and Affected Versions PHP versions 7.3.x through 7.3.31 PHP versions 7.4.x through 7.4.24 PHP versions 8.0.x through 8.0.11

Description The issue is related to the PHP FPM SAPI component, where child worker processes can access and modify memory shared with the main process, potentially causing the root process to conduct invalid memory reads and writes. This can be exploited to escalate privileges from a local unprivileged user to the root user. The vulnerability is associated with errors in access control when running the PHP FPM process.

Recommendations For PHP versions 7.3.x through 7.3.31, update to a version above 7.3.31. For PHP versions 7.4.x through 7.4.24, update to a version above 7.4.24. For PHP versions 8.0.x through 8.0.11, update to a version above 8.0.11. As a temporary workaround, consider restricting access to the PHP FPM SAPI component until a patch is available.