CVE-2021-21285: Docker daemon crash during image pull of malicious image
Impact
Pulling an intentionally malformed Docker image manifest crashes the dockerd daemon.
Patches
Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.
Credits
Maintainers would like to thank Josh Larsen, Ian Coldwater, Duffie Cooley, Rory McCune for working on the vulnerability and Brad Geesaman for responsibly disclosing it to security@docker.com.
Other sources
Docker is vulnerable to a denial of service, caused by improper input validation. By persuading a victim to pull a specially-crafted Docker image, a remote attacker could exploit this vulnerability to cause the dockerd daemon to crash, and results in a denial of service condition.
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-21285?
CVE-2021-21285 is a vulnerability in Docker that allows a remote attacker to cause a denial of service by crashing the dockerd daemon.
How does CVE-2021-21285 work?
CVE-2021-21285 is caused by improper input validation in Docker. By tricking a victim into pulling a specially-crafted Docker image, the attacker can crash the dockerd daemon and cause a denial of service.
Which versions of Docker are affected by CVE-2021-21285?
Docker versions up to and excluding 19.03.15 and versions between 20.0.0 and 20.10.3 are affected by CVE-2021-21285.
How severe is CVE-2021-21285?
CVE-2021-21285 has a severity rating of 6.5, which is considered medium.
How can I fix CVE-2021-21285?
To fix CVE-2021-21285, update Docker to version 19.03.15 or higher if using a version prior to 20. And update to version 20.10.3 or higher if using a version between 20.0.0 and 20.10.3.