CVE-2021-41089: Github.com/docker/docker `docker Cp` Allows Unexpected Chmod Vulnerability
LOWCVE-2021-41089 is a LOW (CVSS 2.8) `docker cp` allows unexpected chmod vulnerability (CWE-281: Improper Preservation of Permissions) affecting Github.com/docker/docker libraries in the Go ecosystem. The issue involves `docker cp` allows unexpected chmod of host files in moby docker engine. Remediation is available by upgrading affected packages to version 20.10.9.
CVE-2021-41089 at a Glance
Security Impact
CVSS: 2.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N).
How to Fix CVE-2021-41089
To remediate this vulnerability, upgrade all affected Github.com/docker/docker dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/docker/docker to 20.10.9Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/docker/dockerHow to Check if You Are Affected
To determine whether your application is affected by CVE-2021-41089, inspect your project dependencies for Github.com/docker/docker:
inspect dependencies for github.com/docker/dockerAnalyze the terminal output to locate any version of Github.com/docker/docker in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 20.10.9), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-281: Improper Preservation of Permissions, where the product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended. In Github.com/docker/docker, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2021-41089 Affected Github.com/docker/docker Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/docker/docker
|
Go |
< 20.10.9
|
20.10.9
|
References
Frequently Asked Questions
What is CVE-2021-41089?
Which Github.com/docker/docker versions are affected?
What version fixes CVE-2021-41089?
Is github.com/docker/docker affected?
What is the CVSS score of CVE-2021-41089?
What CWE is associated with CVE-2021-41089?
How can I check Go dependencies for CVE-2021-41089?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-v994-f8vw-g7j4",
"modified" : "2024-07-03T20:27:20Z",
"published" : "2024-06-10T18:38:43Z",
"aliases" : [ "CVE-2021-41089" ],
"summary" : "`docker cp` allows unexpected chmod of host files in Moby Docker Engine",
"details" : "## Impact\nA bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process.\n\n## Patches\nThis bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.\n\n## Workarounds\nEnsure you only run trusted containers.\n\n## Credits\nThe Moby project would like to thank Lei Wang and Ruizhi Xiao for responsibly disclosing this issue in accordance with the [Moby security policy](https://github.com/moby/moby/blob/master/SECURITY.md).\n\n## For more information\nIf you have any questions or comments about this advisory:\n\n* [Open an issue](https://github.com/moby/moby/issues/new)\n* Email us at security@docker.com if you think you’ve found a security bug",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/docker/docker"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "20.10.9"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/moby/moby/security/advisories/GHSA-v994-f8vw-g7j4"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-41089"
}, {
"type" : "WEB",
"url" : "https://github.com/moby/moby/commit/bce32e5c93be4caf1a592582155b9cb837fc129a"
}, {
"type" : "WEB",
"url" : "https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/moby/moby"
}, {
"type" : "WEB",
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB"
}, {
"type" : "WEB",
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB"
}, {
"type" : "WEB",
"url" : "https://pkg.go.dev/vuln/GO-2024-2913"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-281" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2024-06-10T18:38:43Z",
"nvd_published_at" : "2021-10-04T21:15:00Z"
}
}