id: GO-2024-2500
modules:
    - module: github.com/docker/docker
      versions:
        - fixed: 20.10.9+incompatible
      vulnerable_at: 20.10.8+incompatible
      packages:
        - package: github.com/docker/docker/daemon
          symbols:
            - Daemon.setupContainerMountsRoot
            - Daemon.create
            - NewDaemon
            - setupDaemonRoot
          skip_fix: fix does not work due to incompatible versions
        - package: github.com/docker/docker/daemon/graphdriver/aufs
          symbols:
            - Init
          skip_fix: fix does not work due to incompatible versions
        - package: github.com/docker/docker/daemon/graphdriver/btrfs
          symbols:
            - Init
            - Driver.Create
          skip_fix: fix does not work due to incompatible versions
        - package: github.com/docker/docker/daemon/graphdriver/fuse-overlayfs
          symbols:
            - Init
            - Driver.create
          skip_fix: fix does not work due to incompatible versions
        - package: github.com/docker/docker/daemon/graphdriver/overlay
          symbols:
            - Init
            - Driver.Create
          skip_fix: fix does not work due to incompatible versions
        - package: github.com/docker/docker/daemon/graphdriver/overlay2
          symbols:
            - Init
            - Driver.create
          skip_fix: fix does not work due to incompatible versions
        - package: github.com/docker/docker/daemon/graphdriver/vfs
          symbols:
            - Init
            - Driver.Create
          skip_fix: fix does not work due to incompatible versions
        - package: github.com/docker/docker/daemon/graphdriver/zfs
          symbols:
            - Init
          skip_fix: fix does not work due to incompatible versions
    - module: github.com/moby/moby
      versions:
        - fixed: 20.10.9+incompatible
      vulnerable_at: 20.10.8+incompatible
      packages:
        - package: github.com/moby/moby/daemon
          symbols:
            - Daemon.setupContainerMountsRoot
            - Daemon.create
            - NewDaemon
            - setupDaemonRoot
          skip_fix: fix does not work due to incompatible versions
        - package: github.com/moby/moby/daemon/graphdriver/aufs
          symbols:
            - Init
          skip_fix: fix does not work due to incompatible versions
        - package: github.com/moby/moby/daemon/graphdriver/btrfs
          symbols:
            - Init
            - Driver.Create
          skip_fix: fix does not work due to incompatible versions
        - package: github.com/moby/moby/daemon/graphdriver/fuse-overlayfs
          symbols:
            - Init
            - Driver.create
          skip_fix: fix doesn't work due to build tags
        - package: github.com/moby/moby/daemon/graphdriver/overlay
          symbols:
            - Init
            - Driver.Create
          skip_fix: fix does not work due to incompatible versions
        - package: github.com/moby/moby/daemon/graphdriver/overlay2
          symbols:
            - Init
            - Driver.create
          skip_fix: fix does not work due to incompatible versions
        - package: github.com/moby/moby/daemon/graphdriver/vfs
          symbols:
            - Init
            - Driver.Create
          skip_fix: fix does not work due to incompatible versions
        - package: github.com/moby/moby/daemon/graphdriver/zfs
          symbols:
            - Init
          skip_fix: fix does not work due to incompatible versions
summary: Moby (Docker Engine) Insufficiently restricted permissions on data directory in github.com/docker/docker
cves:
    - CVE-2021-41091
ghsas:
    - GHSA-3fwx-pjgw-3558
credits:
    - Joan Bruguera
references:
    - advisory: https://github.com/moby/moby/security/advisories/GHSA-3fwx-pjgw-3558
    - fix: https://github.com/moby/moby/commit/f0ab919f518c47240ea0e72d0999576bb8008e64
source:
    id: GHSA-3fwx-pjgw-3558
    created: 2024-07-01T15:02:17.770473-04:00
review_status: REVIEWED
unexcluded: EFFECTIVELY_PRIVATE