CVE catalog

CVE-2021-21284

docker.io: CVE-2021-21284

[CVE catalog]

Severity
Medium · CVSS 6CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.06% · Oct 27, 2026

In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandocker.iosid28.5.2+dfsg4-5fixed
Debiandocker.ioforky28.5.2+dfsg4-5fixed
Debiandocker.iotrixie26.1.5+dfsg1-9+deb13u1fixed
Debiandocker.iotrixie-security26.1.5+dfsg1-9+deb13u1fixed
Debiandocker.iobookworm20.10.24+dfsg1-1+deb12u1fixed
Opensusecontainerdleap 15.21.4.4-lp152.2.6.1fixed
Opensusedockerleap 15.220.10.6_ce-lp152.2.12.1fixed
Opensuseruncleap 15.21.0.0~rc93-lp152.2.3.1fixed
Opensusecontainerdleap 15.31.4.4-5.32.1fixed
Opensusedockerleap 15.320.10.6_ce-6.49.3fixed
Opensuseruncleap 15.31.0.0~rc93-1.14.2fixed
Ubuntudocker.iopro1.6.2~dfsg1-1ubuntu4vulnerable
Ubuntudocker.iopro1.10.2-0ubuntu3vulnerable
Ubuntudocker.iopro1.10.2-0ubuntu4vulnerable
Ubuntudocker.iopro1.10.3-0ubuntu1vulnerable
Ubuntudocker.iopro1.10.3-0ubuntu4vulnerable
Ubuntudocker.iopro1.10.3-0ubuntu5vulnerable
Ubuntudocker.iopro1.10.3-0ubuntu6vulnerable
Ubuntudocker.iopro1.11.2-0ubuntu5~16.04vulnerable
Ubuntudocker.iopro1.12.1-0ubuntu13~16.04.1vulnerable
Ubuntudocker.iopro1.12.3-0ubuntu4~16.04.2vulnerable
Ubuntudocker.iopro1.12.6-0ubuntu1~16.04.1vulnerable
Ubuntudocker.iopro1.13.1-0ubuntu1~16.04.2vulnerable
Ubuntudocker.iopro17.03.2-0ubuntu2~16.04.1vulnerable
Ubuntudocker.iopro18.06.1-0ubuntu1~16.04.2vulnerable
Ubuntudocker.iopro18.06.1-0ubuntu1.2~16.04.1vulnerable
Ubuntudocker.iopro18.09.2-0ubuntu1~16.04.1vulnerable
Ubuntudocker.iopro18.09.5-0ubuntu1~16.04.2vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.1vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.4vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.5vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.6vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.7vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.9+esm1vulnerable
Ubuntudocker.iopro18.09.7-0ubuntu1~16.04.9+esm2vulnerable
Ubuntudocker.io18.041.13.1-0ubuntu6vulnerable
Ubuntudocker.io18.0417.03.2-0ubuntu1vulnerable
Ubuntudocker.io18.0417.03.2-0ubuntu3vulnerable
Ubuntudocker.io18.0417.03.2-0ubuntu5vulnerable
Ubuntudocker.io18.0417.12.1-0ubuntu1vulnerable
Ubuntudocker.io18.0418.06.1-0ubuntu1~18.04.1vulnerable
Ubuntudocker.io18.0418.06.1-0ubuntu1.2~18.04.1vulnerable
Ubuntudocker.io18.0418.09.2-0ubuntu1~18.04.1vulnerable
Ubuntudocker.io18.0418.09.5-0ubuntu1~18.04.2vulnerable
Ubuntudocker.io18.0418.09.7-0ubuntu1~18.04.1vulnerable
Ubuntudocker.io18.0418.09.7-0ubuntu1~18.04.3vulnerable
Ubuntudocker.io18.0418.09.7-0ubuntu1~18.04.4vulnerable
Ubuntudocker.io18.0419.03.6-0ubuntu1~18.04.1vulnerable
Ubuntudocker.io18.0419.03.6-0ubuntu1~18.04.2vulnerable
Ubuntudocker.io18.0419.03.6-0ubuntu1~18.04.3vulnerable
Ubuntudocker.io18.0420.10.2-0ubuntu1~18.04.2vulnerable
Ubuntudocker.io18.0420.10.2-0ubuntu1~18.04.3vulnerable
Ubuntudocker.io18.0420.10.7-0ubuntu1~18.04.1fixed
Ubuntudocker.io20.0419.03.2-0ubuntu1vulnerable
Ubuntudocker.io20.0419.03.6-0ubuntu1vulnerable
Ubuntudocker.io20.0419.03.8-0ubuntu1vulnerable
Ubuntudocker.io20.0419.03.8-0ubuntu1.20.04vulnerable
Ubuntudocker.io20.0419.03.8-0ubuntu1.20.04.1vulnerable
Ubuntudocker.io20.0419.03.8-0ubuntu1.20.04.2vulnerable
Ubuntudocker.io20.0420.10.2-0ubuntu1~20.04.2vulnerable
Ubuntudocker.io20.0420.10.2-0ubuntu1~20.04.3vulnerable
Ubuntudocker.io20.0420.10.7-0ubuntu1~20.04.1fixed
Susecontainerdlinux enterprise module for containers 15 sp21.4.4-5.32.1fixed
Susedockerlinux enterprise module for containers 15 sp220.10.6_ce-6.49.3fixed
Suserunclinux enterprise module for containers 15 sp21.0.0~rc93-1.14.2fixed
Susecontainerdlinux enterprise module for containers 15 sp31.4.4-5.32.1fixed
Susedockerlinux enterprise module for containers 15 sp320.10.6_ce-6.49.3fixed
Suserunclinux enterprise module for containers 15 sp31.0.0~rc93-1.14.2fixed
Susecontainerdlinux enterprise high performance computing 15-espos1.4.4-5.32.1fixed
Susedockerlinux enterprise high performance computing 15-espos20.10.6_ce-6.49.3fixed
Suserunclinux enterprise high performance computing 15-espos1.0.0~rc93-1.14.2fixed
Susecontainerdlinux enterprise high performance computing 15-ltss1.4.4-5.32.1fixed
Susedockerlinux enterprise high performance computing 15-ltss20.10.6_ce-6.49.3fixed
Suserunclinux enterprise high performance computing 15-ltss1.0.0~rc93-1.14.2fixed
Susecontainerdlinux enterprise high performance computing 15 sp1-espos1.4.4-5.32.1fixed
Susedockerlinux enterprise high performance computing 15 sp1-espos20.10.6_ce-6.49.3fixed
Suserunclinux enterprise high performance computing 15 sp1-espos1.0.0~rc93-1.14.2fixed
Susecontainerdlinux enterprise high performance computing 15 sp1-ltss1.4.4-5.32.1fixed
Susedockerlinux enterprise high performance computing 15 sp1-ltss20.10.6_ce-6.49.3fixed
Suserunclinux enterprise high performance computing 15 sp1-ltss1.0.0~rc93-1.14.2fixed
Susecontainerdlinux enterprise server 15-ltss1.4.4-5.32.1fixed
Susedockerlinux enterprise server 15-ltss20.10.6_ce-6.49.3fixed
Suserunclinux enterprise server 15-ltss1.0.0~rc93-1.14.2fixed
Susecontainerdlinux enterprise server 15 sp1-bcl1.4.4-5.32.1fixed
Susedockerlinux enterprise server 15 sp1-bcl20.10.6_ce-6.49.3fixed
Suserunclinux enterprise server 15 sp1-bcl1.0.0~rc93-1.14.2fixed
Susecontainerdlinux enterprise server 15 sp1-ltss1.4.4-5.32.1fixed
Susedockerlinux enterprise server 15 sp1-ltss20.10.6_ce-6.49.3fixed
Suserunclinux enterprise server 15 sp1-ltss1.0.0~rc93-1.14.2fixed
Susecontainerdlinux enterprise server for sap applications 151.4.4-5.32.1fixed
Susedockerlinux enterprise server for sap applications 1520.10.6_ce-6.49.3fixed
Suserunclinux enterprise server for sap applications 151.0.0~rc93-1.14.2fixed
Susecontainerdlinux enterprise server for sap applications 15 sp11.4.4-5.32.1fixed
Susedockerlinux enterprise server for sap applications 15 sp120.10.6_ce-6.49.3fixed
Suserunclinux enterprise server for sap applications 15 sp11.0.0~rc93-1.14.2fixed
Susecontainerdmanager proxy 4.01.4.4-5.32.1fixed
Susedockermanager proxy 4.020.10.6_ce-6.49.3fixed
Suseruncmanager proxy 4.01.0.0~rc93-1.14.2fixed
Susecontainerdmanager retail branch server 4.01.4.4-5.32.1fixed
Susedockermanager retail branch server 4.020.10.6_ce-6.49.3fixed
Suseruncmanager retail branch server 4.01.0.0~rc93-1.14.2fixed
Susecontainerdmanager server 4.01.4.4-5.32.1fixed
Susedockermanager server 4.020.10.6_ce-6.49.3fixed
Suseruncmanager server 4.01.0.0~rc93-1.14.2fixed
Susecontainerdlinux enterprise micro 5.01.4.4-5.32.1fixed
Susedockerlinux enterprise micro 5.020.10.6_ce-6.49.3fixed
Suserunclinux enterprise micro 5.01.0.0~rc93-1.14.2fixed
Susecontainerdenterprise storage 61.4.4-5.32.1fixed
Susedockerenterprise storage 620.10.6_ce-6.49.3fixed
Suseruncenterprise storage 61.0.0~rc93-1.14.2fixed
Suseruncenterprise storage 71.0.0~rc93-1.14.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandocker.iosourcesid20.10.3+dfsg1-1not yet assignedNot reportedNot reported
Debiandocker.iosourceforky20.10.3+dfsg1-1not yet assignedNot reportedNot reported
Debiandocker.iosourcetrixie20.10.3+dfsg1-1not yet assignedNot reportedNot reported
Debiandocker.iosourcebookworm20.10.3+dfsg1-1not yet assignedNot reportedNot reported
Opensusecontainerdrpmleap 15.21.4.4-lp152.2.6.1Not reportedOPENSUSE-SU-2021:0878-1Not reported
Opensusedockerrpmleap 15.220.10.6_ce-lp152.2.12.1Not reportedOPENSUSE-SU-2021:0878-1Not reported
Opensuseruncrpmleap 15.21.0.0~rc93-lp152.2.3.1Not reportedOPENSUSE-SU-2021:0878-1Not reported
Opensusecontainerdrpmleap 15.31.4.4-5.32.1Not reportedOPENSUSE-SU-2021:1954-1Not reported
Opensusedockerrpmleap 15.320.10.6_ce-6.49.3Not reportedOPENSUSE-SU-2021:1954-1Not reported
Opensuseruncrpmleap 15.31.0.0~rc93-1.14.2Not reportedOPENSUSE-SU-2021:1954-1Not reported
Ubuntudocker.iodeb18.0420.10.7-0ubuntu1~18.04.1Not reportedUBUNTU-CVE-2021-21284Not reported
Ubuntudocker.iodeb20.0420.10.7-0ubuntu1~20.04.1Not reportedUBUNTU-CVE-2021-21284Not reported
Susecontainerdrpmlinux enterprise module for containers 15 sp21.4.4-5.32.1Not reportedSUSE-SU-2021:1954-1Not reported
Susedockerrpmlinux enterprise module for containers 15 sp220.10.6_ce-6.49.3Not reportedSUSE-SU-2021:1954-1Not reported
Suseruncrpmlinux enterprise module for containers 15 sp21.0.0~rc93-1.14.2Not reportedSUSE-SU-2021:1954-1Not reported
Susecontainerdrpmlinux enterprise module for containers 15 sp31.4.4-5.32.1Not reportedSUSE-SU-2021:1954-1Not reported
Susedockerrpmlinux enterprise module for containers 15 sp320.10.6_ce-6.49.3Not reportedSUSE-SU-2021:1954-1Not reported
Suseruncrpmlinux enterprise module for containers 15 sp31.0.0~rc93-1.14.2Not reportedSUSE-SU-2021:1954-1Not reported
Susecontainerdrpmlinux enterprise high performance computing 15-espos1.4.4-5.32.1Not reportedSUSE-SU-2021:1954-1Not reported
Susedockerrpmlinux enterprise high performance computing 15-espos20.10.6_ce-6.49.3Not reportedSUSE-SU-2021:1954-1Not reported
Suseruncrpmlinux enterprise high performance computing 15-espos1.0.0~rc93-1.14.2Not reportedSUSE-SU-2021:1954-1Not reported
Susecontainerdrpmlinux enterprise high performance computing 15-ltss1.4.4-5.32.1Not reportedSUSE-SU-2021:1954-1Not reported
Susedockerrpmlinux enterprise high performance computing 15-ltss20.10.6_ce-6.49.3Not reportedSUSE-SU-2021:1954-1Not reported
Suseruncrpmlinux enterprise high performance computing 15-ltss1.0.0~rc93-1.14.2Not reportedSUSE-SU-2021:1954-1Not reported
Susecontainerdrpmlinux enterprise high performance computing 15 sp1-espos1.4.4-5.32.1Not reportedSUSE-SU-2021:1954-1Not reported
Susedockerrpmlinux enterprise high performance computing 15 sp1-espos20.10.6_ce-6.49.3Not reportedSUSE-SU-2021:1954-1Not reported
Suseruncrpmlinux enterprise high performance computing 15 sp1-espos1.0.0~rc93-1.14.2Not reportedSUSE-SU-2021:1954-1Not reported
Susecontainerdrpmlinux enterprise high performance computing 15 sp1-ltss1.4.4-5.32.1Not reportedSUSE-SU-2021:1954-1Not reported
Susedockerrpmlinux enterprise high performance computing 15 sp1-ltss20.10.6_ce-6.49.3Not reportedSUSE-SU-2021:1954-1Not reported
Suseruncrpmlinux enterprise high performance computing 15 sp1-ltss1.0.0~rc93-1.14.2Not reportedSUSE-SU-2021:1954-1Not reported
Susecontainerdrpmlinux enterprise server 15-ltss1.4.4-5.32.1Not reportedSUSE-SU-2021:1954-1Not reported
Susedockerrpmlinux enterprise server 15-ltss20.10.6_ce-6.49.3Not reportedSUSE-SU-2021:1954-1Not reported
Suseruncrpmlinux enterprise server 15-ltss1.0.0~rc93-1.14.2Not reportedSUSE-SU-2021:1954-1Not reported
Susecontainerdrpmlinux enterprise server 15 sp1-bcl1.4.4-5.32.1Not reportedSUSE-SU-2021:1954-1Not reported
Susedockerrpmlinux enterprise server 15 sp1-bcl20.10.6_ce-6.49.3Not reportedSUSE-SU-2021:1954-1Not reported
Suseruncrpmlinux enterprise server 15 sp1-bcl1.0.0~rc93-1.14.2Not reportedSUSE-SU-2021:1954-1Not reported
Susecontainerdrpmlinux enterprise server 15 sp1-ltss1.4.4-5.32.1Not reportedSUSE-SU-2021:1954-1Not reported
Susedockerrpmlinux enterprise server 15 sp1-ltss20.10.6_ce-6.49.3Not reportedSUSE-SU-2021:1954-1Not reported
Suseruncrpmlinux enterprise server 15 sp1-ltss1.0.0~rc93-1.14.2Not reportedSUSE-SU-2021:1954-1Not reported
Susecontainerdrpmlinux enterprise server for sap applications 151.4.4-5.32.1Not reportedSUSE-SU-2021:1954-1Not reported
Susedockerrpmlinux enterprise server for sap applications 1520.10.6_ce-6.49.3Not reportedSUSE-SU-2021:1954-1Not reported
Suseruncrpmlinux enterprise server for sap applications 151.0.0~rc93-1.14.2Not reportedSUSE-SU-2021:1954-1Not reported
Susecontainerdrpmlinux enterprise server for sap applications 15 sp11.4.4-5.32.1Not reportedSUSE-SU-2021:1954-1Not reported
Susedockerrpmlinux enterprise server for sap applications 15 sp120.10.6_ce-6.49.3Not reportedSUSE-SU-2021:1954-1Not reported
Suseruncrpmlinux enterprise server for sap applications 15 sp11.0.0~rc93-1.14.2Not reportedSUSE-SU-2021:1954-1Not reported
Susecontainerdrpmmanager proxy 4.01.4.4-5.32.1Not reportedSUSE-SU-2021:1954-1Not reported
Susedockerrpmmanager proxy 4.020.10.6_ce-6.49.3Not reportedSUSE-SU-2021:1954-1Not reported
Suseruncrpmmanager proxy 4.01.0.0~rc93-1.14.2Not reportedSUSE-SU-2021:1954-1Not reported
Susecontainerdrpmmanager retail branch server 4.01.4.4-5.32.1Not reportedSUSE-SU-2021:1954-1Not reported
Susedockerrpmmanager retail branch server 4.020.10.6_ce-6.49.3Not reportedSUSE-SU-2021:1954-1Not reported
Suseruncrpmmanager retail branch server 4.01.0.0~rc93-1.14.2Not reportedSUSE-SU-2021:1954-1Not reported
Susecontainerdrpmmanager server 4.01.4.4-5.32.1Not reportedSUSE-SU-2021:1954-1Not reported
Susedockerrpmmanager server 4.020.10.6_ce-6.49.3Not reportedSUSE-SU-2021:1954-1Not reported
Suseruncrpmmanager server 4.01.0.0~rc93-1.14.2Not reportedSUSE-SU-2021:1954-1Not reported
Susecontainerdrpmlinux enterprise micro 5.01.4.4-5.32.1Not reportedSUSE-SU-2021:1954-1Not reported
Susedockerrpmlinux enterprise micro 5.020.10.6_ce-6.49.3Not reportedSUSE-SU-2021:1954-1Not reported
Suseruncrpmlinux enterprise micro 5.01.0.0~rc93-1.14.2Not reportedSUSE-SU-2021:1954-1Not reported
Susecontainerdrpmenterprise storage 61.4.4-5.32.1Not reportedSUSE-SU-2021:1954-1Not reported
Susedockerrpmenterprise storage 620.10.6_ce-6.49.3Not reportedSUSE-SU-2021:1954-1Not reported
Suseruncrpmenterprise storage 61.0.0~rc93-1.14.2Not reportedSUSE-SU-2021:1954-1Not reported
Suseruncrpmenterprise storage 71.0.0~rc93-1.14.2Not reportedSUSE-SU-2021:1954-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [docker-doc]Unknown

    Source package: [docker.io]

    Details (2)
    • 20.10.24+dfsg1-1+deb12u1 · all · bookworm

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

    • 20.10.24+dfsg1-1+deb12u1 · all · bookworm

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

  • [docker.io]Unknown

    Source package: [docker.io]

    Details (2)
    • 20.10.24+dfsg1-1+deb12u1+b6 · amd64 · bookworm

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

    • 20.10.24+dfsg1-1+deb12u1+b6 · arm64 · bookworm

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

  • Source package: [docker.io]

    Details (2)
    • 20.10.24+dfsg1-1+deb12u1 · all · bookworm

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

    • 20.10.24+dfsg1-1+deb12u1 · all · bookworm

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

[Debian 13 (Trixie)]

  • [docker-cli]Unknown

    Source package: [docker.io]

    Details (4)
    • 26.1.5+dfsg1-9+b13 · amd64 · trixie

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+b13 · arm64 · trixie

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · 13

  • [docker-doc]Unknown

    Source package: [docker.io]

    Details (4)
    • 26.1.5+dfsg1-9 · all · trixie

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9 · all · trixie

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · all · trixie-security

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · all · trixie-security

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · 13

  • [docker.io]Unknown
    Details (4)
    • 26.1.5+dfsg1-9+b13 · amd64 · trixie

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+b13 · arm64 · trixie

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · 13

  • Source package: [docker.io]

    Details (4)
    • 26.1.5+dfsg1-9 · all · trixie

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9 · all · trixie

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · all · trixie-security

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · 13

    • 26.1.5+dfsg1-9+deb13u1 · all · trixie-security

      Fixed · Fixed: 20.10.3+dfsg1-1

      dsa · docker.io · debian · 13

Observed:

References