Candidate: CVE-2021-41091
PublicDate: 2021-10-04 21:15:00 UTC
References: 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41091
 https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558
Description:
 Moby is an open-source project created by Docker to enable software
 containerization. A bug was found in Moby (Docker Engine) where the data
 directory (typically `/var/lib/docker`) contained subdirectories with
 insufficiently restricted permissions, allowing otherwise unprivileged
 Linux users to traverse directory contents and execute programs. When
 containers included executable programs with extended permission bits (such
 as `setuid`), unprivileged Linux users could discover and execute those
 programs. When the UID of an unprivileged Linux user on the host collided
 with the file owner or group inside a container, the unprivileged Linux
 user on the host could discover, read, and modify those files. This bug has
 been fixed in Moby (Docker Engine) 20.10.9. Users should update to this
 version as soon as possible. Running containers should be stopped and
 restarted for the permissions to be fixed. For users unable to upgrade
 limit access to the host to trusted users. Limit access to host volumes to
 trusted containers.
Ubuntu-Description: 
Notes: 
 sbeattie> looks to have possibly been introduced in
   e908cc39018c015084ffbffbc5703ccba5c2fbb7 (v20.10.3)
Mitigation: 
Bugs: 
Priority: medium
Discovered-by:
Assigned-to: 
CVSS:
 nvd: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L [6.3 MEDIUM]


Patches_docker.io:
 upstream: https://github.com/moby/moby/commit/93ac040bf0c0b51d9a7fedaf994bf5bf1d68ee0e
upstream_docker.io: released (v20.10.9)
trusty_docker.io: ignored (out of standard support)
trusty/esm_docker.io: DNE
xenial_docker.io: ignored (out of standard support)
esm-infra/xenial_docker.io: needs-triage
bionic_docker.io: released (20.10.7-0ubuntu5)
focal_docker.io: released (20.10.7-0ubuntu5)
hirsute_docker.io: ignored (reached end-of-life)
impish_docker.io: released (20.10.7-0ubuntu5)
jammy_docker.io: released (20.10.7-0ubuntu5)
devel_docker.io: released (20.10.7-0ubuntu5)