CVE-2021-21703

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284CWE-787

Affected software

VendorProductVersions
PHP GroupPHP>= 7.3.x, <= 7.3.31; >= 7.4.x, < 7.4.25; >= 8.0.X, < 8.0.12

References

Timeline

Published
Oct 25, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-217045.9In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious databaseCVE-2021-217055.3In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() functCVE-2021-217066.5In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may bCVE-2021-217075.3In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URCVE-2021-217089.8In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filterCVE-2021-21714.4Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.33 CVE-2021-21726.5Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.23 and prioCVE-2021-217224.4A ZTE Smart STB is impacted by an information leak vulnerability. The device did not fully verify the log, so attackers could use this vulneCVE-2021-217237.5Some ZTE products have a DoS vulnerability. Due to the improper handling of memory release in some specific scenarios, a remote attacker canCVE-2021-217244.4A ZTE product has a memory leak vulnerability. Due to the product's improper handling of memory release in certain scenarios, a local attackCVE-2021-217255.7A ZTE product has an information leak vulnerability. An attacker with higher authority can go beyond their authority to access files in otheCVE-2021-217262.3Some ZTE products have an input verification vulnerability in the diagnostic function interface. Due to insufficient verification of some pa
CVE-2021-21703: High severity, CVSS 7.0 | Vulnix