CVE-2021-21285: Docker daemon crash during image pull of malicious image
Vulnerability summary
CVE-2021-21285 is a medium (CVSS 6.5) Uncontrolled Resource Consumption vulnerability in debian debian_linux. EPSS estimates a 3.33% chance of exploitation in the next 30 days, higher than 88.6% of scored vulnerabilities.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 10 · Related 12Timeline
- 02-02-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.
CVSS metrics
9 scores · 8 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · GoEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.33%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
Increase +0.04 pp
From 3.29% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard7 products
- docker-machine-driver-harvester< 1.0.4-r1 | < 1.0.5-r0
- py3-dockerAll versions (No fix recorded)
- py3.10-dockerAll versions (No fix recorded)
- py3.11-dockerAll versions (No fix recorded)
- py3.12-dockerAll versions (No fix recorded)
Wolfi7 products
- docker-machine-driver-harvester< 1.0.4-r1 | < 1.0.5-r0
- py3-dockerAll versions (No fix recorded)
- py3.10-dockerAll versions (No fix recorded)
- py3.11-dockerAll versions (No fix recorded)
- py3.12-dockerAll versions (No fix recorded)
Debian2 products
- docker.io< 20.10.3+dfsg1-1
- debian_linuxEOL10.0
Alpine1 product
- docker≥ 20.0.0, < 20.10.3-r0
Docker1 product
- docker< 19.03.15 | ≥ 20.0.0, < 20.10.3
Github.com/moby1 product
- moby< 19.3.15 | ≥ 20.10.0-beta1, < 20.10.3
Moby1 product
- moby< 19.03.15 | ≥ 20.0.0, < 20.10.3
Netapp1 product
- e-series_santricity_os_controller≥ 11.0, ≤ 11.60.3
Ubuntu1 product
- docker.ioAll versions (No fix recorded) | < 20.10.7-0ubuntu1~18.04.1 | < 20.10.7-0ubuntu1~20.04.1
9 vendors · 22 products
References
16 links- github.com/moby/moby/security/advisories/GHSA-6fj5-m822-rqx8X Refsource CONFIRMREPORTAdvisoryWEBThird Party Advisory
- github.com/moby/moby/releases/tag/v20.10.3X Refsource MISCREPORTAdvisoryWEBRelease NotesThird Party Advisory
- github.com/moby/moby/releases/tag/v19.03.15X Refsource MISCREPORTAdvisoryWEBRelease NotesThird Party Advisory
- github.com/moby/moby/commit/8d3179546e79065adefa67cc697c09d0ab137d30X Refsource MISCREPORTFIXWEBPatchThird Party Advisory
www.debian.org/security/2021/dsa-4865Vendor AdvisoryX Refsource DEBIANAdvisoryWEBThird Party Advisory
