=====================================================================

                             CERT-Renater

                 Note d'Information No. 2021/VULN507
_____________________________________________________________________

DATE                : 05/10/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Moby (Docker Engine) versions prior
                                        to 20.10.9.

=====================================================================
https://github.com/moby/moby/security/advisories/GHSA-v994-f8vw-g7j4
https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558
_____________________________________________________________________


`docker cp` allows unexpected chmod of host files

low   thaJeztah    published     GHSA-v994-f8vw-g7j4    Oct 4, 2021


Package
No package listed

Affected versions
< 20.10.9

Patched versions
20.10.9


Description


Impact

A bug was found in Moby (Docker Engine) where attempting to copy files
using docker cp into a specially-crafted container can result in Unix
file permission changes for existing files in the host’s filesystem,
widening access to others. This bug does not directly allow files to be
read, modified, or executed without an additional cooperating process.


Patches

This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should
update to this version as soon as possible. Running containers do not
need to be restarted.


Workarounds

Ensure you only run trusted containers.


Credits

The Moby project would like to thank Lei Wang and Ruizhi Xiao for
responsibly disclosing this issue in accordance with the Moby security
policy.


For more information

If you have any questions or comments about this advisory:

    Open an issue
    Email us at  security@docker.com  if you think you’ve found a
security bug


CVE ID
CVE-2021-41089

Credits

    @LevanaXr LevanaXr
    @ssst0n3 ssst0n3 Lei Wang


_____________________________________________________________________

Insufficiently restricted permissions on data directory

moderate  thaJeztah  published  GHSA-3fwx-pjgw-3558   Oct 4, 2021

Package
No package listed

Affected versions
< 20.10.9

Patched versions
20.10.9


Description

Impact

A bug was found in Moby (Docker Engine) where the data directory
(typically /var/lib/docker) contained subdirectories with insufficiently
restricted permissions, allowing otherwise unprivileged Linux users to
traverse directory contents and execute programs. When containers
included executable programs with extended permission bits (such as
setuid), unprivileged Linux users could discover and execute those
programs. When the UID of an unprivileged Linux user on the host
collided with the file owner or group inside a container, the
unprivileged Linux user on the host could discover, read, and modify
those files.


Patches

This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should
update to this version as soon as possible. Running containers should be
stopped and restarted for the permissions to be fixed.


Workarounds

Limit access to the host to trusted users. Limit access to host volumes
to trusted containers.


Credits

The Moby project would like to thank Joan Bruguera for responsibly
disclosing this issue in accordance with the Moby security policy.


For more information

If you have any questions or comments about this advisory:

    Open an issue
    Email us at security@docker.com if you think you’ve found a security bug



CVE ID
CVE-2021-41091

CVSS Score
5.9 Moderate
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L


Credits

    @joanbm joanbm Joan Bruguera


=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================