Skip to content
Fencer Vulns
medium 6.8

CVE-2021-21284 json

privilege escalation in Moby

published 2021-02-02 5 y ago modified 2026-09-10 59 d ago also EUVD-2024-0280 , GHSA-7452-xqpj-6rpc

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.

Patch / fix

  • go github.com/moby/moby 19.3.15, 20.10.3
  • docker docker 19.03.15, 20.10.3
  • docker.io Debian 14, Debian 13, Debian 12 20.10.3+dfsg1-1

debian advisories DEBIAN-CVE-2021-21284

  • docker.io Ubuntu 18.04 LTS 20.10.7-0ubuntu1~18.04.1
  • docker.io Ubuntu 20.04 LTS 20.10.7-0ubuntu1~20.04.1

ubuntu advisories UBUNTU-CVE-2021-21284

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • docker-stable SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +12 more 24.0.9_ce-150000.1.25.1
  • runc SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +14 more 1.0.0~rc93-1.14.2
  • docker SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +13 more 20.10.6_ce-6.49.3
  • containerd SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +13 more 1.4.4-5.32.1
  • runc SLE Module for Containers 12 1.0.0~rc93-16.8.1
  • docker SLE Module for Containers 12 20.10.6_ce-98.66.1
  • containerd SLE Module for Containers 12 1.4.4-16.38.1
  • golang-github-docker-libnetwork SLE Module for Containers 12 0.7.0.1+gitr2908_55e924b8a842-37.1

suse advisories SUSE-SU-2025:03545-1SUSE-SU-2025:03540-1SUSE-SU-2021:1954-1SUSE-SU-2021:1458-1SUSE-SU-2021:0445-1SUSE-SU-2021:0435-1

  • docker-stable openSUSE Tumbleweed 24.0.9_ce-15.1
  • docker openSUSE Tumbleweed 20.10.6_ce-2.1
  • runc openSUSE Leap 15.3 1.0.0~rc93-1.14.2
  • docker openSUSE Leap 15.3 20.10.6_ce-6.49.3
  • containerd openSUSE Leap 15.3 1.4.4-5.32.1
  • runc openSUSE Leap 15.2 1.0.0~rc93-lp152.2.3.1
  • docker openSUSE Leap 15.2 20.10.6_ce-lp152.2.12.1
  • containerd openSUSE Leap 15.2 1.4.4-lp152.2.6.1

opensuse advisories openSUSE-SU-2025:15589-1openSUSE-SU-2024:10722-1openSUSE-SU-2021:1954-1openSUSE-SU-2021:0878-1openSUSE-SU-2021:0278-1

  • docker Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 20.10.3-r0

alpine advisories ALPINE-CVE-2021-21284

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • docker Arch Linux 1:20.10.3-1

arch linux advisories AVG-1528

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-21284 updated cvss 6.0

docker: access to remapped root allows privilege escalation to real root

  • Red Hat Enterprise Linux 7 docker
    affected: no fix planned “Out of support scope”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.08% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
GitHub 3.1 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
NVD 3.1 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
NVD 2.0 2.7 AV:A/AC:L/Au:S/C:N/I:P/A:N

Affected packages

ecosystem package affected fixed in
go github.com/moby/moby
<19.3.15
>=20.10.0-beta1, <20.10.3
19.3.15
20.10.3

Affected products

  • moby moby

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of moby/moby published their own advisory on GitHub. Reviewed sources take precedence over it.