CVE-2021-21284: privilege escalation in Moby
Vulnerability summary
CVE-2021-21284 is a medium (CVSS 6.8) vulnerability in debian debian_linux. EPSS estimates a 1.08% chance of exploitation in the next 30 days, higher than 65% of scored vulnerabilities.
Not severe (CVSS 6.8, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 12 · Related 14Timeline
- 02-02-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.
CVSS metrics
9 scores · 8 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- OSV · GoEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- NVDNIST6.8MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- OSV · AlpineEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
EPSS trend
Probability
1.08%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 1.06% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: adjacent network, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard7 products
- docker-machine-driver-harvester< 1.0.4-r1 | < 1.0.5-r0
- py3-dockerAll versions (No fix recorded)
- py3.10-dockerAll versions (No fix recorded)
- py3.11-dockerAll versions (No fix recorded)
- py3.12-dockerAll versions (No fix recorded)
Wolfi7 products
- docker-machine-driver-harvester< 1.0.4-r1 | < 1.0.5-r0
- py3-dockerAll versions (No fix recorded)
- py3.10-dockerAll versions (No fix recorded)
- py3.11-dockerAll versions (No fix recorded)
- py3.12-dockerAll versions (No fix recorded)
Debian2 products
- docker.io< 20.10.3+dfsg1-1
- debian_linuxEOL10.0
Alpine1 product
- docker≥ 20.0.0, < 20.10.3-r0
Docker1 product
- docker< 19.03.15 | ≥ 20.0.0, < 20.10.3
Github.com/moby1 product
- moby< 19.3.15 | ≥ 20.10.0-beta1, < 20.10.3
Moby1 product
- moby< 19.03.15 | ≥ 20.0.0, < 20.10.3
Netapp1 product
- e-series_santricity_os_controller≥ 11.0.0, ≤ 11.60.3
Ubuntu1 product
- docker.ioAll versions (No fix recorded) | < 20.10.7-0ubuntu1~18.04.1 | < 20.10.7-0ubuntu1~20.04.1
9 vendors · 22 products
References
16 links- github.com/moby/moby/releases/tag/v20.10.3X Refsource MISCREPORTAdvisoryWEBRelease NotesThird Party Advisory
- github.com/moby/moby/releases/tag/v19.03.15X Refsource MISCREPORTAdvisoryWEBRelease NotesThird Party Advisory
- github.com/moby/moby/security/advisories/GHSA-7452-xqpj-6rpcX Refsource CONFIRMREPORTAdvisoryWEBThird Party Advisory
- github.com/moby/moby/commit/64bd4485b3a66a597c02c95f5776395e540b2c7cX Refsource MISCREPORTFIXWEBPatchThird Party Advisory
www.debian.org/security/2021/dsa-4865Vendor AdvisoryX Refsource DEBIANAdvisoryWEBThird Party Advisory
