Skip to content

moby docker daemon crash during image pull of malicious image

Moderate severity GitHub Reviewed Published Feb 2, 2021 in moby/moby • Updated Jan 31, 2024

Package

gomod github.com/moby/moby (Go)

Affected versions

< 19.3.15
>= 20.10.0-beta1, < 20.10.3

Patched versions

19.3.15
20.10.3

Description

Impact

Pulling an intentionally malformed Docker image manifest crashes the dockerd daemon.

Patches

Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.

Credits

Maintainers would like to thank Josh Larsen, Ian Coldwater, Duffie Cooley, Rory McCune for working on the vulnerability and Brad Geesaman for responsibly disclosing it to security@docker.com.

References

@tiborvass tiborvass published to moby/moby Feb 2, 2021
Published by the National Vulnerability Database Feb 2, 2021
Published to the GitHub Advisory Database Jan 31, 2024
Reviewed Jan 31, 2024
Last updated Jan 31, 2024

Severity

Moderate
6.5
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weaknesses

CVE ID

CVE-2021-21285

GHSA ID

GHSA-6fj5-m822-rqx8

Source code

No known source code

Credits

Checking history
See something to contribute? Suggest improvements for this vulnerability.