CVE-2021-41089

`docker cp` allows unexpected chmod of host files

Severity Score

6.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.

Moby es un proyecto de código abierto creado por Docker para permitir la contenedorización de software. Se ha encontrado un fallo en Moby (Docker Engine) en el que el intento de copiar archivos mediante `docker cp` en un contenedor especialmente diseñado puede dar lugar a cambios en los permisos de archivos Unix para los archivos existentes en el sistema de archivos del host, ampliando el acceso a otros. Este fallo no permite directamente la lectura, modificación o ejecución de archivos sin un proceso adicional que coopere. Este error ha sido corregido en Moby (Docker Engine) 20.10.9. Los usuarios deben actualizar a esta versión lo antes posible. Los contenedores en ejecución no necesitan ser reiniciados

*Credits: N/A

CVSS Scores

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Attack Vector

Local

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-09-15 CVE Reserved
2021-10-04 CVE Published
2023-03-08 EPSS Updated
2024-08-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-281: Improper Preservation of Permissions

CAPEC

References (5)

URL	Tag	Source
https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf	X_refsource_confirm
https://github.com/moby/moby/security/advisories/GHSA-v994-f8vw-g7j4	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://github.com/moby/moby/commit/bce32e5c93be4caf1a592582155b9cb837fc129a	2023-11-07

URL	Date	SRC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mobyproject Search vendor "Mobyproject"		Moby Search vendor "Mobyproject" for product "Moby"				< 20.10.9 Search vendor "Mobyproject" for product "Moby" and version " < 20.10.9"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				34 Search vendor "Fedoraproject" for product "Fedora" and version "34"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				35 Search vendor "Fedoraproject" for product "Fedora" and version "35"		-		Affected