Bug 1924740 (CVE-2021-21284)

Summary:	CVE-2021-21284 docker: access to remapped root allows privilege escalation to real root
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amurdaca, bdettelb, caswilli, dramseur, dwalsh, jhunter, kaycoth, kmitts, lsm5, mcascell, mgala, mjudeiki, tomckay
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	docker 19.03.15, docker 20.10.3	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the `userns-remap` feature of Docker. The root user in the remapped namespace can modify files under /var/lib/docker/<remapping>, leading to possible privilege escalation to the root user in the host. The highest threat from this vulnerability is to data integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-28 11:24:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1934044, 1934045
Bug Blocks:	1924746

Description Guilherme de Almeida Suckevicz 2021-02-03 14:33:41 UTC

In Docker before versions 19.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.

Comment 1 Mauro Matteo Cascella 2021-02-19 14:55:00 UTC

External References:

https://github.com/moby/moby/security/advisories/GHSA-7452-xqpj-6rpc

Comment 3 Mauro Matteo Cascella 2021-03-03 14:49:41 UTC

Upstream commits:
https://github.com/moby/moby/commit/edb62a3ace8c4303822a391b38231e577f8c2ee8
https://github.com/moby/moby/commit/bfedd2725971303efb7a2fe5d6990317b381622f
https://github.com/moby/moby/commit/e908cc39018c015084ffbffbc5703ccba5c2fbb7

Comment 4 Mauro Matteo Cascella 2021-03-03 16:10:17 UTC

Support for user namespaces (--userns-remap) was introduced in Docker-1.10.0: https://docs.docker.com/engine/release-notes/prior-releases/#security-6.