CVE-2021-21284
privilege escalation in Moby
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.
En Docker versiones anteriores a 9.03.15, 20.10.3, se presenta una vulnerabilidad que involucra la opción --userns-remap en la que un acceso a una root reasignada permite una escalada de privilegios a la root actual. Cuando se usa "--userns-remap", si el usuario root en el espacio de nombres reasignado tiene acceso al sistema de archivos del host, puede modificar archivos en "/var/lib/docker/(remapping)" que causa la escritura de archivos con privilegios extendidos. Las versiones 20.10.3 y 19.03.15 contienen parches que evitan una escalada de privilegios del usuario reasignado
An update that solves four vulnerabilities and has 13 fixes is now available. This update for containerd, docker, runc fixes the following issues. Docker was updated to 20.10.6-ce Switch version to use -ce suffix rather than _ce to avoid confusing other tools. Fixed a potential privilege escalation when the root user in the remapped namespace has access to the host filesystem. Fixed an issue where pulling a malformed Docker image manifest crashes the dockerd daemon. Btrfs quotas being removed by Docker regularly runc was updated to v1.0.0~rc93. Use the upstream runc package. Fixed /dev/null is not available. Fixed a symlink-exchange attack vulnarability. Containerd was updated to v1.4.4. Fixed a potential information leak through environment variables. Handle a requirement from docker. This update was imported from the SUSE:SLE-15:Update update project.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-12-22 CVE Reserved
- 2021-02-02 CVE Published
- 2024-08-03 CVE Updated
- 2026-01-02 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| https://github.com/moby/moby/releases/tag/v19.03.15 | Release Notes | |
| https://github.com/moby/moby/releases/tag/v20.10.3 | Release Notes | |
| https://github.com/moby/moby/security/advisories/GHSA-7452-xqpj-6rpc | Third Party Advisory | |
| https://security.netapp.com/advisory/ntap-20210226-0005 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/moby/moby/commit/64bd4485b3a66a597c02c95f5776395e540b2c7c | 2022-04-29 | |
| https://security.gentoo.org/glsa/202107-23 | 2022-04-29 |
| URL | Date | SRC |
|---|---|---|
| https://docs.docker.com/engine/release-notes/#20103 | 2022-04-29 | |
| https://www.debian.org/security/2021/dsa-4865 | 2022-04-29 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Docker Search vendor "Docker" | Docker Search vendor "Docker" for product "Docker" | < 19.03.15 Search vendor "Docker" for product "Docker" and version " < 19.03.15" | - |
Affected
| ||||||
| Docker Search vendor "Docker" | Docker Search vendor "Docker" for product "Docker" | >= 20.0.0 < 20.10.3 Search vendor "Docker" for product "Docker" and version " >= 20.0.0 < 20.10.3" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | E-series Santricity Os Controller Search vendor "Netapp" for product "E-series Santricity Os Controller" | >= 11.0.0 <= 11.60.3 Search vendor "Netapp" for product "E-series Santricity Os Controller" and version " >= 11.0.0 <= 11.60.3" | - |
Affected
| ||||||