NVD Vulnerability Detail

CVE-2021-21284

Summary	In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.
Publication Date	Feb. 3, 2021, 3:15 a.m.
Registration Date	Feb. 3, 2021, 10:02 a.m.
Last Update	Nov. 21, 2024, 2:47 p.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:10.0:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:a:netapp:e-series_santricity_os_controller::::::::		11.0.0	11.60.3

Related information, measures and tools

No	URL	タグ
1	https://docs.docker.com/engine/release-notes/#20103	Release Notes Vendor Advisory
2	https://docs.docker.com/engine/release-notes/#20103	Release Notes Vendor Advisory
3	https://github.com/moby/moby/commit/64bd4485b3a66a597c02c95f5776395e540b2c7c	Patch Third Party Advisory
4	https://github.com/moby/moby/commit/64bd4485b3a66a597c02c95f5776395e540b2c7c	Patch Third Party Advisory
5	https://github.com/moby/moby/releases/tag/v19.03.15	Release Notes Third Party Advisory
6	https://github.com/moby/moby/releases/tag/v19.03.15	Release Notes Third Party Advisory
7	https://github.com/moby/moby/releases/tag/v20.10.3	Release Notes Third Party Advisory
8	https://github.com/moby/moby/releases/tag/v20.10.3	Release Notes Third Party Advisory
9	https://github.com/moby/moby/security/advisories/GHSA-7452-xqpj-6rpc	Third Party Advisory
10	https://github.com/moby/moby/security/advisories/GHSA-7452-xqpj-6rpc	Third Party Advisory
11	https://security.gentoo.org/glsa/202107-23	Patch Third Party Advisory
12	https://security.gentoo.org/glsa/202107-23	Patch Third Party Advisory
13	https://security.netapp.com/advisory/ntap-20210226-0005/	Third Party Advisory
14	https://security.netapp.com/advisory/ntap-20210226-0005/	Third Party Advisory
15	https://www.debian.org/security/2021/dsa-4865	Third Party Advisory
16	https://www.debian.org/security/2021/dsa-4865	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-22	パス・トラバーサル	https://cwe.mitre.org/data/definitions/22.html

JVN Vulnerability Information

Docker におけるパストラバーサルの脆弱性

Title	Docker におけるパストラバーサルの脆弱性
Summary	Docker には、パストラバーサルの脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 1, 2021, midnight
Registration Date	Oct. 26, 2021, 5:21 p.m.
Last Update	Oct. 26, 2021, 5:21 p.m.

Affected System

Debian

Debian GNU/Linux

NetApp

E-Series SANtricity OS Controller Software

Docker

Docker 19.03.15 未満

Docker 20.10.3 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-21284	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21284
National Vulnerability Database (NVD)
2	CVE-2021-21284	https://nvd.nist.gov/vuln/detail/CVE-2021-21284

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-4865-1	https://www.debian.org/security/2021/dsa-4865
Docker
2	Docker Engine release notes (#20.10.3)	https://docs.docker.com/engine/release-notes/#20103
GitHub
3	Access to remapped root allows privilege escalation to real root	https://github.com/moby/moby/security/advisories/GHSA-7452-xqpj-6rpc
4	Merge pull request #41964 from thaJeztah/CVE-2021-21284_master	https://github.com/moby/moby/commit/64bd4485b3a66a597c02c95f5776395e540b2c7c
5	v19.03.15	https://github.com/moby/moby/releases/tag/v19.03.15
6	v20.10.3	https://github.com/moby/moby/releases/tag/v20.10.3
NetApp Advisory
7	NTAP-20210226-0005	https://security.netapp.com/advisory/ntap-20210226-0005/

Change Log

No	Changed Details	Date of change
1	[2021年10月26日] 掲載	Oct. 26, 2021, 5:21 p.m.