CVE-2021-41091mediumCWE-281

CVE-2021-41091: medium-severity vulnerability in moby

Insufficiently restricted permissions on data directory in Docker Engine

Published · Updated

Follow this CVE+ Monitor moby+ Monitor docker.io

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 2.8%
In short

Docker Engine had weak file permissions in its data directory that allowed unprivileged users to access, execute, and modify files belonging to containers. This could let regular users run privileged programs or access sensitive container data.

Technical detail

Moby (Docker Engine) failed to properly restrict permissions on `/var/lib/docker` subdirectories, enabling unprivileged local users to traverse directories and execute setuid binaries from containers, or read/modify files when UID/GID collisions occurred between host and container contexts. Exploitation requires local host access and depends on container executable permissions and UID mapping configurations.

Summary generated and translated by AI from the official description.
Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Affected products
moby · moby
Related CVEs — moby

In the same product, most dangerous first.

CVE-2024-41110CRITICALMoby authz zero length regressionEPSS 16.5%CVE-2026-34040HIGHMoby: AuthZ plugin bypass with oversized request bodyEPSS 9.3%CVE-2021-21285MEDIUMDocker daemon crash during image pull of malicious imageEPSS 3.3%CVE-2023-28840HIGHmoby/moby's dockerd daemon encrypted overlay network may be unauthenticatedEPSS 2.6%CVE-2023-28842MEDIUMmoby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticatedEPSS 1.4%CVE-2021-21284MEDIUMprivilege escalation in MobyEPSS 1.1%