CVE-2021-21703

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.(CVE-2021-21703)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Local privilege escalation via PHP-FPM (CVE-2021-21703)

• php: SSRF bypass in FILTER_VALIDATE_URL (CVE-2021-21705)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es):

• php: Local privilege escalation via PHP-FPM (CVE-2021-21703)
• php: SSRF bypass in FILTER_VALIDATE_URL (CVE-2021-21705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.

• CVE-2021-21704: fix integer overflow and subsequent incorrect buffer allocation
• CVE-2021-21705: fix incorrect url password validation
• CVE-2021-21703: fix incorrect shared memory management, which led to priv escalation

• SECURITY UPDATE: Process crash and information disclosure
  • debian/patches/CVE-2020-7068.patch: fix access-after-free for actual_alias pointer
  • CVE-2020-7068
• SECURITY UPDATE: logic error due to invalid input validation
  • debian/patches/CVE-2020-7071.patch: add validation fo url->user field
  • CVE-2020-7071
• SECURITY UPDATE: program crash due to null pointer dereference
  • debian/patches/CVE-2021-21702.patch: pass empty string instead for NULL pointers to soap_error1(). Check NULL pointer in attr_is_equal_ex() and node_is_equal_ex()
  • CVE-2021-21702
• SECURITY UPDATE: integer overflow and subsequent incorrect buffer allocation
  • debian/patches/CVE-2021-21704.patch: add checks that prevent the overflow, replace strcat() with more secure strlcat()
  • CVE-2021-21704
• SECURITY UPDATE: logic error due to incorrect input validation
  • debian/patches/CVE-2021-21705.patch: fix validation of url password with FILTER_VALIDATE_URL parameter,
  • CVE-2021-21705
• SECURITY UPDATE: priv escalation due to shared memory between worker processes
  • debian/patches/CVE-2021-21703.patch: change scoreboard->proc type to array of structs and use scoreboard->nprocs only in child processes
  • CVE-2021-21703

• CVE-2021-21703: fix incorrect shared memory management, which led to priv escalation
• CVE-2021-21705: fix integer overflow and subsequent incorrect buffer allocation

• CVE-2021-21703: fix oob R/W in root process leading to privelege escalation

• CVE-2021-21703: fix oob R/W in root process leading to privelege escalation

• CVE-2021-21702: Fix null pointer crash because of malformed SOAP server response
• CVE-2021-21703: Fix error in php fpm shared memory organization leading to privilage escalation
• CVE-2022-31625: Fix freeing of uninitialized memory leading to RCE
• CVE-2022-31626: Fix buffer overflow in mysqlnd driver leading to RCE
• CVE-2023-0568: Fix array overrun when appending slash to paths in DOM and XML cases
• CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed multipart body parts and printing upload limit exceed error message only once
• CVE-2023-3823: Fix external entity loading in XML without enabling it, by sanitizing libxml2 globals before parsing
• CVE-2023-3824: Fix buffer mismanagement in phar_dir_read()

• CVE-2021-21702: fix NULL pointer dereference in SoapClient
• CVE-2021-21703: fix OOB R/W in root process leading to privilege escalation
• CVE-2022-31625: don't free uninitialized parameters in pg_query_params/pg_send_execute that have led to RCE
• CVE-2022-31626: fix mysqlnd/pdo password of excessive length triggering buffer overflow leading to RCE
• CVE-2022-31630: fix OOB read due to insufficient input validation in imageloadfont()
• CVE-2022-37454: fix buffer overflow in the Keccak XKCP SHA-3 reference implementation
• CVE-2023-0662: fix DoS vulnerability when parsing multipart request body

Updated php packages fix security vulnerability:

In PHP versions 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user (CVE-2021-21703).

The php packages have been updated to 8.0.12 that fixes this issue and other bugs.

This update for php7 fixes the following issues:

• CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050).

• CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041).

• Added patch to prevent memory access violation in php7 when running test suite (bsc#1175508)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for php7 fixes the following issues:

• CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050).

• CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041).

• Added patch to prevent memory access violation in php7 when running test suite (bsc#1175508)

These are all security issues fixed in the php8-8.0.12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the php7-7.4.25-1.1 package on the GA media of openSUSE Tumbleweed.

This update for php74 fixes the following issues:

• CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050).

This update for php72 fixes the following issues:

• CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050).

This update for php7 fixes the following issues:

• CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050).

• CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041).

• Added patch to prevent memory access violation in php7 when running test suite (bsc#1175508)

This update for php7 fixes the following issues:

• CVE-2021-21703: Fixed local privilege escalation via PHP-FPM (bsc#1192050).
• CVE-2021-21707: Fixed special character breaks path in xml parsing (bsc#1193041).
• CVE-2017-8923: Fixed denial of service (application crash) when using .= with a long string (zend_string_extend func in Zend/zend_string.h) (bsc#1038980).
• CVE-2015-9253: Fixed endless loop when the master process restarts a child process using program execution functions (bsc#1081790).

This update for php8 fixes the following issues:

• php8 was updated to version 8.0.24
• php8 was updated to version 8.0.23 (jsc#SLE-23639).
• CVE-2021-21703: Fixed a local privilege escalation via PHP-FPM. (bsc#1192050)
• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)
• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)
• Fixed missing devel package requires pear and pecl extensions (jsc#SLE-24723, bsc#1200772).

This update for php7 fixes the following issues:

• Version update to 7.2.34 [jsc#SLE-23639]

• CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).

• Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).

This update for php74 fixes the following issues:

• Version update to 7.4.33:

• CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

• Version update to 7.4.32 (jsc#SLE-23639)

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

This update for php7 fixes the following issues:

• Version update to 7.4.33:

• CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

• Version update to 7.4.32 (jsc#SLE-23639)

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

It was discovered that PHP-FPM in PHP incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code.