Skip to content
Fencer Vulns
low 2.8

CVE-2021-41089 json

`docker cp` allows unexpected chmod of host files

published 2021-10-04 5 y ago modified 2026-09-10 59 d ago also EUVD-2024-2176 , GHSA-v994-f8vw-g7j4 , GO-2024-2913

cvss
2.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits
0
none known

Summary

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.

Patch / fix

  • go github.com/docker/docker 20.10.9, 20.10.9+incompatible
  • go github.com/moby/moby 20.10.9+incompatible
  • mobyproject moby 20.10.9
  • docker.io Debian 14, Debian 13, Debian 12 20.10.10+dfsg1-1

debian advisories DEBIAN-CVE-2021-41089

  • docker.io Ubuntu 18.04 LTS 20.10.7-0ubuntu1~18.04.2
  • docker.io Ubuntu 20.04 LTS 20.10.7-0ubuntu1~20.04.2
  • docker.io Ubuntu 22.04 LTS 20.10.7-0ubuntu7
  • docker.io Ubuntu Pro 16.04 LTS 18.09.7-0ubuntu1~16.04.9+esm1

ubuntu advisories UBUNTU-CVE-2021-41089

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • docker-stable SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +12 more 24.0.9_ce-150000.1.25.1
  • docker SLE Module for Containers 15 SP3, SLE Micro 5.1, SLE Micro 5.0 20.10.12_ce-159.1
  • containerd SLE Module for Containers 15 SP3, SLE Micro 5.1, SLE Micro 5.0 1.4.12-60.1
  • docker SLE Module for Containers 12 20.10.12_ce-98.75.1
  • containerd SLE Module for Containers 12 1.4.12-16.49.1
  • runc SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +12 more 1.0.2-23.1
  • docker SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +11 more 20.10.9_ce-156.1
  • containerd SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +11 more 1.4.11-56.1

suse advisories SUSE-SU-2025:03545-1SUSE-SU-2025:03540-1SUSE-SU-2022:0334-1SUSE-SU-2022:0213-1SUSE-SU-2021:3506-1SUSE-SU-2021:3336-1

  • docker-stable openSUSE Tumbleweed 24.0.9_ce-15.1
  • docker openSUSE Tumbleweed 20.10.9_ce-1.2
  • docker openSUSE Leap 15.3 20.10.12_ce-159.1
  • containerd openSUSE Leap 15.3 1.4.12-60.1
  • docker-kubic openSUSE Leap 15.3 20.10.12_ce-159.1
  • runc openSUSE Leap 15.2 1.0.2-lp152.2.9.1
  • docker openSUSE Leap 15.2 20.10.9_ce-lp152.2.18.1
  • containerd openSUSE Leap 15.2 1.4.11-lp152.2.12.1

opensuse advisories openSUSE-SU-2025:15589-1openSUSE-SU-2024:11579-1openSUSE-SU-2022:0334-1openSUSE-SU-2021:1404-1openSUSE-SU-2021:3506-1

  • docker Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 20.10.9-r0

alpine advisories ALPINE-CVE-2021-41089

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • docker Arch Linux 1:20.10.9-1

arch linux advisories AVG-2440

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-41089 updated cvss 5.3

moby: `docker cp` allows unexpected chmod of host file

  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm-assisted-service-container, rhacm2/multicluster-operators-subscription-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux 7 docker
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift-compliance-openscap-container, openshift-file-integrity-operator-container
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-agent-rhel8, rhai-tech-preview/assisted-installer-reporter-rhel8
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat Quay 3 quay/quay-builder-rhel8
    affected: no fix available
  • Red Hat Migration Toolkit for Virtualization 2.2 migration-toolkit-virtualization/mtv-controller-rhel8 2.2.0-39
    fixed: vendor fix RHEA-2021:5066
  • Red Hat Migration Toolkit for Virtualization 2.2 migration-toolkit-virtualization/mtv-ui-rhel8 2.2.0-60, migration-toolkit-virtualization/mtv-rhel8-operator 2.2.0-59, migration-toolkit-virtualization/mtv-virt-v2v-rhel8 2.2.0-18, migration-toolkit-virtualization/mtv-operator-bundle 2.2.0-104, migration-toolkit-virtualization/mtv-validation-rhel8 2.2.0-36, migration-toolkit-virtualization/mtv-must-gather-rhel8 2.2.0-57, +1 more Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/search-rhel8, rhacm2/agent-service-rhel8, rhacm2/assisted-installer-rhel8, rhacm2/assisted-installer-agent-rhel8, rhacm2/assisted-installer-reporter-rhel8, rhacm2/multicluster-operators-subscription-release-rhel8 Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-167-09 updated cvss 2.8

Siemens SCALANCE LPE9403 Third-Party Vulnerabilities

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 2.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
GitHub 3.1 2.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
NVD 3.1 6.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
NVD 2.0 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P

Affected packages

ecosystem package affected fixed in
go github.com/docker/docker
<20.10.9
<20.10.9+incompatible
20.10.9
20.10.9+incompatible
go github.com/moby/moby
<20.10.9+incompatible
20.10.9+incompatible

Affected products

  • moby moby

Classification

Weakness
  • CWE-281 Improper Preservation of Permissions
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of moby/moby published their own advisory on GitHub. Reviewed sources take precedence over it.