TI-2021-17933 Aliases CVE-2021-41091 GHSA-3fwx-pjgw-3558

Insufficiently restricted permissions on data directory in Docker Engine

LOW 33CWE-281Published 2021-10-04 · Updated 2024-08-04

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Partial Red Hat: 1 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers.

Why it matters now

EPSS 0.02848 86th percentileScored 2026-11-07

Fix Partial moby (moby): 20.10.9github.com/moby/moby (Go): 20.10.9+1 more productRed Hat: 1 advisoryRed Hat: 1 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
moby	moby	before 20.10.9	20.10.9	Patch available	CNA
—	github.com/moby/moby (Go)	before 20.10.9	20.10.9	Patch available	GHSA-3fwx-pjgw-3558
—	github.com/docker/docker (Go)	before 20.10.9	20.10.9	Patch available	GHSA-3fwx-pjgw-3558

moby Vendormoby Affected before 20.10.9 Fixed in 20.10.9 Patch available CNA
github.com/moby/moby (Go) Vendor— Affected before 20.10.9 Fixed in 20.10.9 Patch available GHSA-3fwx-pjgw-3558
github.com/docker/docker (Go) Vendor— Affected before 20.10.9 Fixed in 20.10.9 Patch available GHSA-3fwx-pjgw-3558

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:mobyproject:moby::::::::	before 20.10.9	Vulnerable	Mobyproject
cpe:2.3:o:fedoraproject:fedora:34:::::::*	34	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:35:::::::*	35	Vulnerable	Fedoraproject

cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:* Versions before 20.10.9 Vulnerable ·Mobyproject
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject

Remediation

Fix · CNA moby (moby) Fixed in 20.10.9
Fix · GHSA-3fwx-pjgw-3558 github.com/moby/moby (Go) Fixed in 20.10.9 Advisory →
Fix · GHSA-3fwx-pjgw-3558 github.com/docker/docker (Go) Fixed in 20.10.9 Advisory →

Red Hat 1 advisory

RHSA-2022:0735 Released 2022-03-03 · Red Hat rating Important
Red Hat Advanced Cluster Management 2.4.2 security updates and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2021-10-04
moby — FEDORA-2021-b5a9a481a2
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-17931 `docker cp` allows unexpected chmod of host filesPriority LOW 28
Show all 2 records → Advisory →
Advisory · 2021-10-04
moby — FEDORA-2021-df975338d4
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-17931 `docker cp` allows unexpected chmod of host filesPriority LOW 28
Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix yet
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat OpenShift Container Platform 4	Affected	No fix yet
Red Hat OpenShift Container Platform Assisted Installer 1	Affected	No fix yet
8Base-MTV-2.2	Fixed	—

Not affected: 6 products

Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat Advanced Cluster Security 3
Red Hat OpenShift Container Platform Assisted Installer 1
Red Hat OpenShift Virtualization 2
Red Hat OpenShift Virtualization 4
Red Hat Quay 3

Timeline

2026-10-02 Threatist record created from CVE-2021-41091
2026-10-03 Alias added: GHSA-3fwx-pjgw-3558

References

Patch 1

https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64

Advisory 4

Other 4

TI-2026-14229 Tar extraction in moby/go-archive can write outside the destination directory via link following CVSS 4.0HIGH 7.1
TI-2021-12512 Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx CVSS 3.1HIGH 7.1
TI-2024-27462 Moby authz zero length regression CVSS 3.1CRITICAL 10.0
TI-2024-15672 BuildKit interactive containers API does not validate entitlements check CVSS 3.1CRITICAL 9.8
TI-2024-15671 BuildKit possible host system access from mount stub cleaner CVSS 3.1CRITICAL 10.0
TI-2026-26365 Moby: AuthZ plugin bypass with oversized request body CVSS 3.1HIGH 8.8

See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences