Skip to content
Fencer Vulns
medium 6.3

CVE-2021-41091 json

Insufficiently restricted permissions on data directory in Docker Engine

published 2021-10-04 5 y ago modified 2026-09-10 59 d ago also EUVD-2024-0231 , GHSA-3fwx-pjgw-3558 , GO-2024-2500

cvss
6.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.8%
EPSS 2.8% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers.

Patch / fix

  • go github.com/moby/moby 20.10.9, 20.10.9+incompatible
  • go github.com/docker/docker 20.10.9, 20.10.9+incompatible
  • mobyproject moby 20.10.9
  • docker.io Debian 14, Debian 13, Debian 12 20.10.10+dfsg1-1

debian advisories DEBIAN-CVE-2021-41091

  • docker.io Ubuntu 18.04 LTS 20.10.7-0ubuntu5~18.04.2
  • docker.io Ubuntu 20.04 LTS 20.10.7-0ubuntu5~20.04.1
  • docker.io Ubuntu 22.04 LTS 20.10.7-0ubuntu5

ubuntu advisories UBUNTU-CVE-2021-41091

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • docker-stable SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +12 more 24.0.9_ce-150000.1.25.1
  • docker SLE Module for Containers 15 SP3, SLE Micro 5.1, SLE Micro 5.0 20.10.12_ce-159.1
  • containerd SLE Module for Containers 15 SP3, SLE Micro 5.1, SLE Micro 5.0 1.4.12-60.1
  • docker SLE Module for Containers 12 20.10.12_ce-98.75.1
  • containerd SLE Module for Containers 12 1.4.12-16.49.1
  • runc SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +12 more 1.0.2-23.1
  • docker SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +11 more 20.10.9_ce-156.1
  • containerd SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +11 more 1.4.11-56.1

suse advisories SUSE-SU-2025:03545-1SUSE-SU-2025:03540-1SUSE-SU-2022:0334-1SUSE-SU-2022:0213-1SUSE-SU-2021:3506-1SUSE-SU-2021:3336-1

  • docker openSUSE Leap 15.3 20.10.12_ce-159.1
  • containerd openSUSE Leap 15.3 1.4.12-60.1
  • docker-kubic openSUSE Leap 15.3 20.10.12_ce-159.1
  • runc openSUSE Leap 15.2 1.0.2-lp152.2.9.1
  • docker openSUSE Leap 15.2 20.10.9_ce-lp152.2.18.1
  • containerd openSUSE Leap 15.2 1.4.11-lp152.2.12.1
  • runc openSUSE Leap 15.3 1.0.2-23.1
  • docker openSUSE Leap 15.3 20.10.9_ce-156.1

opensuse advisories openSUSE-SU-2022:0334-1openSUSE-SU-2021:1404-1openSUSE-SU-2021:3506-1

  • docker Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 20.10.9-r0

alpine advisories ALPINE-CVE-2021-41091

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • docker Arch Linux 1:20.10.9-1

arch linux advisories AVG-2440

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-41091 updated cvss 6.3

moby: data directory contains subdirectories with insufficiently restricted permissions, which could lead to directory traversal

  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/agent-service-rhel8, rhacm-assisted-service-container
    affected: no fix available
  • Red Hat Enterprise Linux 7 docker
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift-compliance-openscap-container, openshift-compliance-operator-container, openshift-file-integrity-operator-container, openshift4-wincw/windows-machine-config-rhel8-operator
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-agent-rhel8, rhai-tech-preview/assisted-installer-reporter-rhel8
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat Migration Toolkit for Virtualization 2.2 migration-toolkit-virtualization/mtv-ui-rhel8 2.2.0-60, migration-toolkit-virtualization/mtv-rhel8-operator 2.2.0-59, migration-toolkit-virtualization/mtv-virt-v2v-rhel8 2.2.0-18, migration-toolkit-virtualization/mtv-controller-rhel8 2.2.0-39, migration-toolkit-virtualization/mtv-operator-bundle 2.2.0-104, migration-toolkit-virtualization/mtv-validation-rhel8 2.2.0-36, +2 more
    fixed: vendor fix RHEA-2021:5066
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/search-rhel8, rhacm2/assisted-installer-rhel8, rhacm2/assisted-installer-agent-rhel8, rhacm2/assisted-installer-reporter-rhel8, rhacm2/multicluster-operators-subscription-rhel8, rhacm2/multicluster-operators-subscription-release-rhel8 Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-rhel8-operator Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8 Red Hat OpenShift Virtualization 2 vm-import-operator-container Red Hat OpenShift Virtualization 4 container-native-virtualization/vm-import-operator-rhel8 Red Hat Quay 3 quay/quay-builder-rhel8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-167-09 updated cvss 6.3

Siemens SCALANCE LPE9403 Third-Party Vulnerabilities

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

2.85% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
GitHub 3.1 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD 3.1 6.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
NVD 2.0 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected packages

ecosystem package affected fixed in
go github.com/moby/moby
<20.10.9
<20.10.9+incompatible
20.10.9
20.10.9+incompatible
go github.com/docker/docker
<20.10.9
<20.10.9+incompatible
20.10.9
20.10.9+incompatible

Affected products

  • moby moby

Classification

Weakness
  • CWE-281 Improper Preservation of Permissions
  • CWE-732 Incorrect Permission Assignment for Critical Resource
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of moby/moby published their own advisory on GitHub. Reviewed sources take precedence over it.