{"id":"CVE-2021-21284","aliases":["GHSA-7452-xqpj-6rpc"],"title":"moby Access to remapped root allows privilege escalation to real root","summary":"moby Access to remapped root allows privilege escalation to real root","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","vendor":"moby","product":"github.com/moby/moby","ecosystem":"go","affected":["github.com/moby/moby < 19.3.15","github.com/moby/moby >= 20.10.0-beta1, < 20.10.3"],"patched":["github.com/moby/moby 19.3.15","github.com/moby/moby 20.10.3"],"published":"2024-01-31","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:09.391693398Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-7452-xqpj-6rpc","references":[{"url":"https://github.com/moby/moby/security/advisories/GHSA-7452-xqpj-6rpc"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21284"},{"url":"https://github.com/moby/moby/commit/64bd4485b3a66a597c02c95f5776395e540b2c7c"},{"url":"https://docs.docker.com/engine/release-notes/#20103"},{"url":"https://github.com/moby/moby/releases/tag/v19.03.15"},{"url":"https://github.com/moby/moby/releases/tag/v20.10.3"},{"url":"https://security.gentoo.org/glsa/202107-23"},{"url":"https://security.netapp.com/advisory/ntap-20210226-0005"},{"url":"https://www.debian.org/security/2021/dsa-4865"}],"tags":["osv","go"],"epss":0.01065,"epssPercentile":0.63259,"ingestedAt":"2026-07-09T18:56:36.027Z","slug":"CVE-2021-21284","body":"## Overview\n\n### Impact\n\nWhen using `--userns-remap`, if the root user in the remapped namespace has access to the host filesystem they can modify files under `/var/lib/docker/<remapping>` that cause writing files with extended privileges.\n\n### Patches\n\nVersions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.\n\n### Credits\n\nMaintainers would like to thank Alex Chapman for discovering the vulnerability; @awprice, @nathanburrell, @raulgomis, @chris-walz, @erin-jensby, @bassmatt, @mark-adams, @dbaxa for working on it and Zac Ellis for responsibly disclosing it to security@docker.com\n\n## Affected packages\n\n- `github.com/moby/moby < 19.3.15`\n- `github.com/moby/moby >= 20.10.0-beta1, < 20.10.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/moby/moby 19.3.15`\n- `github.com/moby/moby 20.10.3`","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":37.4,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}