CVE-2021-41089

Description

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using docker cp into a specially-crafted container can result in Unix file permission changes for existing files in the hosts filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.

Risk Information

Base Score

6.3

MODERATE

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

EPSS Score

Exploitation Probability

0.033

Associated Vulnerability

Vulnerability	OS Platform
Linux container runtime (USN-5103-1) docker.io_20.10.7-0ubuntu5~18.04.3_i386.deb	Linux
Linux container runtime (USN-5103-1) docker.io_20.10.7-0ubuntu5~18.04.3_amd64.deb	Linux
Linux container runtime (USN-5103-1) docker.io_20.10.7-0ubuntu5~20.04.2_amd64.deb	Linux
Linux container runtime (USN-5103-1) docker.io_20.10.7-0ubuntu5~21.04.2_amd64.deb	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234