Unauthenticated crashtracker IPC allows arbitrary root file write

Impact

Any local, unprivileged process sharing a network namespace with a root PHP-FPM master can reach the sidecar's crashtracker IPC without authorization and make it create or append to an attacker-chosen file with attacker-controlled contents as root. This allows local privilege escalation to root on any host or container running the affected sidecar in thread (or default auto) mode.

Patches

This issue is patched in version 1.26.0 and later of dd-trace-php.

Workarounds

Avoid using thread sidecar mode (and the default auto mode that falls back to it) on any host or container where untrusted local users or processes share a network namespace with a root PHP-FPM master.

Credits

Thanks to Mayur Udiniya aka roughwire (https://x.com/roughwire/) for responsibly disclosing this vulnerability via the Datadog Bug Bounty program.