Published: 04/10/2021 Updated: 07/11/2023

CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9

CVSS v3 Base Score: 6.3 | Impact Score: 3.7 | Exploitability Score: 2

VMScore: 410

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mobyproject moby
fedoraproject fedora 34
fedoraproject fedora 35

Synopsis Important: Red Hat Advanced Cluster Management 242 security updates and bug fixes Type/Severity Security Advisory: Important Topic Red Hat Advanced Cluster Management for Kubernetes 242 General Availabilityrelease images This update provides security fixes, fixes bugs, and updates the container imagesRed Hat Product Security ha ...

A bug was found in Moby (Docker Engine) where attempting to copy files using docker cp into a specially-crafted container can result in Unix file permission changes for existing files in the host 2019s filesystem, widening access to others This bug does not directly allow files to be read, modified, or executed without an additional cooperating pr ...

A bug was found in Moby (Docker Engine) where the data directory (typically /var/lib/docker) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs When containers included executable programs with extended permission bits (such as setuid) ...

A file permissions vulnerability was found in Moby (Docker Engine) Copying files by using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host's filesystem, which might lead to permissions escalation and allow an attacker access to restricted data (CVE-2021-41089) Moby is an open ...

A file permissions vulnerability was found in Moby (Docker Engine) Copying files by using into a specially-crafted container can result in Unix file permission changes for existing files in the host's filesystem, which might lead to permissions escalation and allow an attacker access to restricted data (CVE-2021-41089) Moby is an open-source pro ...

A file permissions vulnerability was found in Moby (Docker Engine) Copying files by using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host's filesystem, which might lead to permissions escalation and allow an attacker access to restricted data (CVE-2021-41089) Moby is an open ...

POC for CVE-2021-41091

CVE-2021-41091 This exploit offers an in-depth look at the CVE-2021-41091 security vulnerability and provides a step-by-step guide on how to utilize the exploit script to achieve privilege escalation on a host Vulnerability Summary CVE-2021-41091 is a flaw in Moby (Docker Engine) that allows unprivileged Linux users to traverse and execute programs within the data directory (u

Collection of Linux Kernel exploits for CTF.

Linux kernal Exploits This repo is a collection of kernal exploits Sources githubcom/briskets/CVE-2021-3493 githubcom/UncleJ4ck/CVE-2021-41091 githubcom/xkaneiki/CVE-2023-0386 githubcom/leesh3288/CVE-2023-4911 Disclaimer I am not the author of any of this exploit

CVE-2021-41091

CWE-281 https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64 https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558 https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/https://access.redhat.com/errata/RHSA-2022:0735 https://nvd.nist.gov https://github.com/UncleJ4ck/CVE-2021-41091 https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-09 https://alas.aws.amazon.com/ALAS-2021-1537.html

CVE-2021-41091

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect