CVE-2021-21284: 
Docker vulnerability analysis and mitigation

CVE-2021-21284 affects Docker versions prior to 19.03.15 and 20.10.3. The vulnerability involves the --userns-remap option, where access to remapped root allows privilege escalation to real root. When using this option, if the root user in the remapped namespace has access to the host filesystem, they can modify files under /var/lib/docker/ that cause writing files with extended privileges (GitHub Advisory).

The vulnerability has a CVSS v3.1 score of 6.8 (MEDIUM) with a vector of CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N. The issue specifically relates to file permissions and privilege management in Docker's user namespace remapping functionality. The vulnerability allows a user with remapped root access to escalate privileges to real root through manipulation of files in the Docker state directory (NetApp Advisory).

Successful exploitation of this vulnerability could lead to privilege escalation, allowing a remapped root user to gain full root access on the host system. This could potentially compromise the security of the entire host system by allowing unauthorized access to and modification of sensitive files (Rapid7).

The vulnerability requires local access and the use of the --userns-remap option in Docker. An attacker would need to have access to a container with remapped root privileges to exploit this vulnerability. The attack vector is considered adjacent (AV:A) with low attack complexity (AC:L) (NetApp Advisory).

The vulnerability has been patched in Docker versions 19.03.15 and 20.10.3. Users should upgrade to these or later versions to prevent exploitation. The patches prevent privilege escalation from remapped users by implementing proper file permission controls (GitHub Release, GitHub Release).