GHSA-v994-f8vw-g7j4 CVE-2021-41089 GO-2024-2913
`docker cp` allows unexpected chmod of host files in Moby Docker Engine
- Severity
- 2.8 / 10
- Low · CVSS 3.1
- Exploit chance (EPSS)
- 0.29%
- Chance of exploitation in the next 30 days. Higher than 21.62% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-281 Improper Preservation of Permissions
- Fix
- Available
- 2 packages have a fixed version
Description
Impact
A bug was found in Moby (Docker Engine) where attempting to copy files using docker cp into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process.
Patches
This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.
Workarounds
Ensure you only run trusted containers.
Credits
The Moby project would like to thank Lei Wang and Ruizhi Xiao for responsibly disclosing this issue in accordance with the Moby security policy.
For more information
If you have any questions or comments about this advisory:
- Open an issue
- Email us at security@docker.com if you think you’ve found a security bug
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/docker/docker | < 20.10.9 |
20.10.9 |
| github.com/docker/docker | < 20.10.9+incompatible |
20.10.9+incompatible |
| github.com/moby/moby | < 20.10.9+incompatible |
20.10.9+incompatible |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/docker/docker Go → 20.10.9
- go
go get github.com/docker/docker@v20.10.9 && go mod tidy
github.com/moby/moby Go → 20.10.9+incompatible
- go
go get github.com/moby/moby@v20.10.9+incompatible && go mod tidy
Severity breakdown
CVSS 3.1 2.8
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
- Attack vector
- Local
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-281: Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
References
Advisories
Packages
Other links
- github.com/moby/moby/security/advisories/GHSA-v994-f8vw-g7j4
- github.com/moby/moby/commit/bce32e5c93be4caf1a592582155b9cb837fc129a
- cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFAD…
- pkg.go.dev/vuln/GO-2024-2913
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-rg2x-37c3-w2rh Docker: Race condition in docker cp allows bind mount redirection to host path | High | Also affects github.com/docker/docker |
| GHSA-vp62-88p7-qqf5 Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap | Medium | Also affects github.com/docker/docker |
| GHSA-x86f-5xw2-fm2r Docker: `PUT /containers/{id}/archive` executes container binary on the host | High | Also affects github.com/docker/docker |
| GO-2026-4887 Moby has AuthZ plugin bypass when provided oversized request bodies | High | Also affects github.com/docker/docker |
| GHSA-pxq6-2prw-chj9 Moby has an Off-by-one error in its plugin privilege validation | High | Also affects github.com/docker/docker |
| GHSA-4vq8-7jfc-9cvp Moby firewalld reload removes bridge network isolation | Medium | Also affects github.com/docker/docker |
| GHSA-x4rx-4gw3-53p4 Moby firewalld reload makes published container ports accessible from remote hosts | Medium | Also affects github.com/docker/docker |
| GHSA-v23v-6jw2-98fq Authz zero length regression | Critical | Also affects github.com/docker/docker |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor