CVE-2021-41091Medium· 5.9▾ TwilightPoC availableMoby (Docker Engine) Insufficiently restricted permissions on data directory
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 32.5 · likelihood 0.6 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
2.7%
2.7% → 2.8%
3 GitHub repos
Last analysed / modified upstream
A bug was found in Moby (Docker Engine) where the data directory (typically /var/lib/docker) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files.
This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed.
Limit access to the host to trusted users. Limit access to host volumes to trusted containers.
The Moby project would like to thank Joan Bruguera for responsibly disclosing this issue in accordance with the Moby security policy.
If you have any questions or comments about this advisory:
github.com/moby/moby < 20.10.9github.com/docker/docker < 20.10.9Upgrade to a patched release:
github.com/moby/moby 20.10.9github.com/docker/docker 20.10.9Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-24769Medium· 5.9Moby (Docker Engine) started with non-empty inheritable Linux process capabilities
CVE-2024-36621Medium· 6.5Moby Race Condition vulnerability
CVE-2020-27534Medium· 5.3Path Traversal in Moby builder
CVE-2021-21284Medium· 6.8moby Access to remapped root allows privilege escalation to real root
CVE-2021-21285Medium· 6.5moby docker daemon crash during image pull of malicious image
CVE-2024-23652Critical· 10.0BuildKit vulnerable to possible host system access from mount stub cleaner