CVE-2021-41089: `docker cp` allows unexpected chmod of host files
First published: Tue Sep 28 2021(Updated: )
## Impact A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. ## Patches This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted. ## Workarounds Ensure you only run trusted containers. ## Credits The Moby project would like to thank Lei Wang and Ruizhi Xiao for responsibly disclosing this issue in accordance with the [Moby security policy](https://github.com/moby/moby/blob/master/SECURITY.md). ## For more information If you have any questions or comments about this advisory: * [Open an issue](https://github.com/moby/moby/issues/new) * Email us at security@docker.com if you think you’ve found a security bug
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mobyproject Moby | <20.10.9 | |
| Fedoraproject Fedora | =34 | |
| Fedoraproject Fedora | =35 | |
| redhat/moby | <20.10.9 | 20.10.9 |
| go/github.com/docker/docker | <20.10.9 | 20.10.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
- https://github.com/moby/moby/commit/bce32e5c93be4caf1a592582155b9cb837fc129a
- https://github.com/moby/moby/security/advisories/GHSA-v994-f8vw-g7j4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
- https://access.redhat.com/errata/RHSA-2022:0735
- https://bugzilla.redhat.com/show_bug.cgi?id=2008592
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
- https://nvd.nist.gov/vuln/detail/CVE-2021-41089
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB
- https://github.com/advisories/GHSA-v994-f8vw-g7j4 (Advisory)
- https://pkg.go.dev/vuln/GO-2024-2913
Frequently Asked Questions
What is CVE-2021-41089?
CVE-2021-41089 is a vulnerability in Moby (Docker Engine) that allows for Unix file permission changes when using 'docker cp' to copy files into a specially-crafted container.
How does CVE-2021-41089 affect Moby?
CVE-2021-41089 affects Moby (Docker Engine) when attempting to copy files using 'docker cp' into a specially-crafted container.
What is the severity of CVE-2021-41089?
The severity of CVE-2021-41089 is medium, with a CVSS score of 6.3.
Which versions of Moby are affected by CVE-2021-41089?
Versions up to and excluding 20.10.9 of Moby are affected by CVE-2021-41089.
How do I fix CVE-2021-41089 in Moby?
To fix CVE-2021-41089 in Moby, update to version 20.10.9 or apply the necessary patches provided by the vendor.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/remedy
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-41089
- agent/software-canonical-lookup
- agent/severity
- agent/author
- agent/description
- collector/nvd-cve
- source/NVD
- agent/softwarecombine
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-v994-f8vw-g7j4
- agent/references
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/tags
- agent/event
- vendor/mobyproject
- canonical/mobyproject moby
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/34
- version/fedoraproject fedora/35
- package-manager/redhat
- package-manager/go