Worker-writable shared-memory metadata allows local privilege escalation to root

Impact

A local attacker running as a low-privileged PHP-FPM worker can corrupt shared-memory structures that the root sidecar owns but hands to workers as writable. This allows memory disclosure or corruption on any host or container where a root-master PHP-FPM sidecar runs in thread (or default auto) mode alongside untrusted workers.

Patches

This issue is patched in version 1.26.0 and later of the dd-trace-php library

Workarounds

• Avoid thread sidecar mode (and default auto mode, which falls back to it) on any host or container where a root-master PHP-FPM sidecar coexists with untrusted or multi-tenant workers.
• Where thread mode is required, run the PHP-FPM master as non-root or isolate the root PHP-FPM master from untrusted workloads on separate hosts or namespaces so no lower-UID process can reach the sidecar's IPC surface.

Credits

Thanks to Mayur Udiniya aka roughwire (https://x.com/roughwire/) for responsibly disclosing this vulnerability via the Datadog Bug Bounty program.