CVE-2021-21285: Docker daemon crash during image pull of malicious image
Impact
Pulling an intentionally malformed Docker image manifest crashes the dockerd daemon.
Patches
Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.
Credits
Maintainers would like to thank Josh Larsen, Ian Coldwater, Duffie Cooley, Rory McCune for working on the vulnerability and Brad Geesaman for responsibly disclosing it to security@docker.com.
Other sources
Docker is vulnerable to a denial of service, caused by improper input validation. By persuading a victim to pull a specially-crafted Docker image, a remote attacker could exploit this vulnerability to cause the dockerd daemon to crash, and results in a denial of service condition.
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/docker.ioto a version that resolves this vulnerability.Fixed in 18.09.1+dfsg1-7.1+deb10u3Fixed in 20.10.5+dfsg1-1+deb11u2Fixed in 20.10.24+dfsg1-1Fixed in 20.10.25+dfsg1-2 - Upgrade
Upgrade
go/github.com/moby/mobyto a version that resolves this vulnerability.Fixed in 20.10.3 - Upgrade
Upgrade
go/github.com/moby/mobyto a version that resolves this vulnerability.Fixed in 19.3.15 - Upgrade
Upgrade
alpine/dockerto a version that resolves this vulnerability.Fixed in 20.10.3-r0 - Upgrade
Upgrade
Dockerto a version that resolves this vulnerability.Fixed in 20.10.3
Event History
Frequently Asked Questions
What is CVE-2021-21285?
CVE-2021-21285 is a vulnerability in Docker that allows a remote attacker to cause a denial of service by crashing the dockerd daemon.
How does CVE-2021-21285 work?
CVE-2021-21285 is caused by improper input validation in Docker. By tricking a victim into pulling a specially-crafted Docker image, the attacker can crash the dockerd daemon and cause a denial of service.
Which versions of Docker are affected by CVE-2021-21285?
Docker versions up to and excluding 19.03.15 and versions between 20.0.0 and 20.10.3 are affected by CVE-2021-21285.
How severe is CVE-2021-21285?
CVE-2021-21285 has a severity rating of 6.5, which is considered medium.
How can I fix CVE-2021-21285?
To fix CVE-2021-21285, update Docker to version 19.03.15 or higher if using a version prior to 20. And update to version 20.10.3 or higher if using a version between 20.0.0 and 20.10.3.