CVE-2021-41089

Publication date 4 October 2021

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

6.3 · Medium

Score breakdown

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.

From the Ubuntu Security Team

Lei Wang and Ruizhi Xiao discovered that the Moby Docker engine subsystem in Docker incorrectly allowed the docker cp command to make permissions changes in the host filesystem in some situations. A local attacker could possibly use to this to expose sensitive information or gain administrative privileges.

Status

Package Ubuntu Release Status
docker.io 22.04 LTS jammy
Fixed 20.10.7-0ubuntu7
21.10 impish
Fixed 20.10.7-0ubuntu5
21.04 hirsute
Fixed 20.10.7-0ubuntu1~21.04.2
20.04 LTS focal
Fixed 20.10.7-0ubuntu1~20.04.2
18.04 LTS bionic
Fixed 20.10.7-0ubuntu1~18.04.2
16.04 LTS xenial
14.04 LTS trusty Not in release

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
docker.io

Severity score breakdown

Parameter Value
Base score 6.3 · Medium
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Scope Changed
Confidentiality Low
Integrity impact Low
Availability impact Low
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

References

Related Ubuntu Security Notices (USN)

    • USN-5103-1
    • docker.io vulnerability
    • 4 October 2021

Other references