Cyber Resilience

CVE-2021-41091

MediumLPE

Published: 04 October 2021

Published
04 October 2021
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 6.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
EPSS Score 0.0475 89.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-41091 is a medium-severity Improper Preservation of Permissions (CWE-281) vulnerability in Fedoraproject Fedora. Its CVSS base score is 6.3 (Medium).

Operationally, ranked in the top 10.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory…

more

contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade limit access to the host to trusted users. Limit access to host volumes to trusted containers.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

mobyproject
moby
≤ 20.10.9
fedoraproject
fedora
34, 35

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-281 CWE-732

Forces removal or modification of permissions no longer required after reassignment, preventing improper preservation of old access rights.

addresses: CWE-732

Procedures support proper permission assignment for critical resources through documented controls.

addresses: CWE-732

Attribute management for resources provides a mechanism to assign and maintain correct permissions based on security labels.

addresses: CWE-732

Prevents overly permissive assignments to critical resources by limiting to task needs.

addresses: CWE-732

Training policy covers correct permission assignment, reducing the ability to exploit incorrect permission assignments for critical resources.

addresses: CWE-732

Training on permission management reduces incorrect permission assignments for critical resources.

addresses: CWE-732

Audit logs and logging tools are critical resources whose protection requires correct permission assignments to block unauthorized actions.

addresses: CWE-732

Assessments review permission assignments on critical resources to confirm correctness, mitigating exploitation via incorrect permissions.

References