Read the docs
TI-2021-17931 Aliases CVE-2021-41089GHSA-v994-f8vw-g7j4

`docker cp` allows unexpected chmod of host files

Priority LOW 28CWE-281Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.

Why it matters now

EPSS 0.0029 21st percentileScored 2026-11-07
Fix Partial moby (moby): 20.10.9github.com/docker/docker (Go): 20.10.9Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
mobymobybefore 20.10.920.10.9Patch availableCNA
—github.com/docker/docker (Go)before 20.10.920.10.9Patch availableGHSA-v994-f8vw-g7j4
  • moby Vendormoby Affected before 20.10.9 Fixed in 20.10.9 Patch available CNA
  • github.com/docker/docker (Go) Vendor— Affected before 20.10.9 Fixed in 20.10.9 Patch available GHSA-v994-f8vw-g7j4

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:*before 20.10.9VulnerableMobyproject
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
  • cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:* Versions before 20.10.9 Vulnerable ·Mobyproject
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA moby (moby) Fixed in 20.10.9
  • Fix · GHSA-v994-f8vw-g7j4 github.com/docker/docker (Go) Fixed in 20.10.9 Advisory →

Red Hat 1 advisory

  • RHSA-2022:0735 Released 2022-03-03 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.4.2 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    moby — FEDORA-2021-b5a9a481a2

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2021-17933 Insufficiently restricted permissions on data directory in Docker EnginePriority LOW 33
    Show all 2 records → Advisory →
  • Advisory ·

    moby — FEDORA-2021-df975338d4

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2021-17933 Insufficiently restricted permissions on data directory in Docker EnginePriority LOW 33
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform Assisted Installer 1AffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
8Base-MTV-2.2Fixed—
Not affected: 3 products
  • 8Base-MTV-2.2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat OpenShift Container Platform Assisted Installer 1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41089
  2. 2026-10-03 Alias added: GHSA-v994-f8vw-g7j4

References

Patch 1

Advisory 4

Other 5

  • TI-2026-14229 Tar extraction in moby/go-archive can write outside the destination directory via link following CVSS 4.0HIGH 7.1
  • TI-2021-12512 Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx CVSS 3.1HIGH 7.1
  • TI-2024-27462 Moby authz zero length regression CVSS 3.1CRITICAL 10.0
  • TI-2024-15672 BuildKit interactive containers API does not validate entitlements check CVSS 3.1CRITICAL 9.8
  • TI-2024-15671 BuildKit possible host system access from mount stub cleaner CVSS 3.1CRITICAL 10.0
  • TI-2026-26365 Moby: AuthZ plugin bypass with oversized request body CVSS 3.1HIGH 8.8
See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences