CVE-2021-41089: `docker cp` allows unexpected chmod of host files
Impact A bug was found in Moby (Docker Engine) where attempting to copy files using docker cp into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process.
Patches This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.
Workarounds Ensure you only run trusted containers.
Credits The Moby project would like to thank Lei Wang and Ruizhi Xiao for responsibly disclosing this issue in accordance with the Moby security policy.
For more information If you have any questions or comments about this advisory:
Open an issue Email us at security@docker.com if you think you’ve found a security bug
Other sources
A bug was found in Moby (Docker Engine) where attempting to copy files using docker cp into a specially-crafted container can result in Unix file permission changes for existing files in the host's filesystem, widening access to others.
References:
https://github.com/moby/moby/security/advisories/GHSA-v994-f8vw-g7j4
— Red Hat
Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using docker cp into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/mobyto a version that resolves this vulnerability.Fixed in 20.10.9 - Upgrade
Upgrade
go/github.com/docker/dockerto a version that resolves this vulnerability.Fixed in 20.10.9 - Upgrade
Upgrade
Moby (Docker Engine)to a version that resolves this vulnerability.Fixed in 20.10.9 - Compensating control
Ensure you only run trusted containers.
Event History
Frequently Asked Questions
What is CVE-2021-41089?
CVE-2021-41089 is a vulnerability in Moby (Docker Engine) that allows for Unix file permission changes when using 'docker cp' to copy files into a specially-crafted container.
How does CVE-2021-41089 affect Moby?
CVE-2021-41089 affects Moby (Docker Engine) when attempting to copy files using 'docker cp' into a specially-crafted container.
What is the severity of CVE-2021-41089?
The severity of CVE-2021-41089 is medium, with a CVSS score of 6.3.
Which versions of Moby are affected by CVE-2021-41089?
Versions up to and excluding 20.10.9 of Moby are affected by CVE-2021-41089.
How do I fix CVE-2021-41089 in Moby?
To fix CVE-2021-41089 in Moby, update to version 20.10.9 or apply the necessary patches provided by the vendor.