| शीर्षक | PHP-FPM Local root privilege escalation |
|---|
| विवरण | Overview of the bug: A low-privilege process can read and write an array of pointers used by the main process, running as root, through shared memory. An attacker can leverage this problem to change a 32-bit integer from zero to one in the main process's memory, or clear a memory region. By leveraging the primitive multiple times, it is possible to reach another bug, make the main process execute code, and thus escalate privileges.
Vulnerable versions: The exploit technique documented here makes use of a feature that appeared in PHP 7.2. However, the pointers in the SHM have been present from the first implementation, dating from PHP 5.3.7! The bug was patched by converting scoreboard->procs to an array of scoreboards (no pointers anymore) and making sure scoreboard->nprocs only gets used by workers. You can find the main commit here. The patched release is PHP-8.0.12. |
|---|
| स्रोत | ⚠️ https://www.ambionics.io/blog/php-fpm-local-root |
|---|
| उपयोगकर्ता | misc (UID 3) |
|---|
| सबमिशन | 25/10/2021 02:34 PM (5 साल पहले) |
|---|
| संयम | 26/10/2021 03:40 PM (1 day later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 185425 [php-fpm तक 8.0.11 Shared Memory बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|