CVE-2021-21703

Name	CVE-2021-21703
Description	In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2794-1, DSA-4992-1, DSA-4993-1
Debian Bugs	997003

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php7.4 (PTS)	bullseye	7.4.33-1+deb11u5	fixed
	bullseye (security)	7.4.33-1+deb11u6	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
php7.0	source	stretch	7.0.33-0+deb9u12	DLA-2794-1
php7.0	source	(unstable)	(unfixed)
php7.3	source	buster	7.3.31-1~deb10u1	DSA-4993-1
php7.3	source	(unstable)	(unfixed)
php7.4	source	bullseye	7.4.25-1+deb11u1	DSA-4992-1
php7.4	source	(unstable)	7.4.26-1		997003
php8.0	source	(unstable)	(unfixed)

Notes

Fixed in 8.0.12, 7.4.25
PHP Bug: http://bugs.php.net/81026
https://github.com/php/php-src/commit/fadb1f8c1d08ae62b4f0a16917040fde57a3b93b
https://www.ambionics.io/blog/php-fpm-local-root
https://www.openwall.com/lists/oss-security/2021/10/26/7