CVE-2021-21285: 
Docker vulnerability analysis and mitigation

CVE-2021-21285 is a vulnerability discovered in Docker versions before 9.03.15 and 20.10.3, where pulling an intentionally malformed Docker image manifest could cause the dockerd daemon to crash (GitHub Advisory, NVD). The vulnerability was disclosed and patched in February 2021.

The vulnerability stems from insufficient validation of image manifests during the pull operation. When pulling a Docker image, if the manifest contains an invalid layer digest, it could trigger a crash in the dockerd daemon. This vulnerability has been assigned a CVSS score of 6.5 (MEDIUM) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NetApp Advisory).

The successful exploitation of this vulnerability could lead to a Denial of Service (DoS) condition by causing the Docker daemon to crash when pulling a maliciously crafted image (GitHub Advisory, NetApp Advisory).

The vulnerability requires an attacker to convince a user to pull a maliciously crafted Docker image. The attack can be executed remotely, requires low complexity, and does not require privileges or user interaction beyond initiating the image pull (NetApp Advisory).

The vulnerability has been patched in Docker versions 19.03.15 and 20.10.3. Users are advised to upgrade to these versions or later to prevent potential exploitation (GitHub Advisory, Debian Advisory).

The vulnerability was responsibly disclosed to security@docker.com by Brad Geesaman. The security community, including Josh Larsen, Ian Coldwater, Duffie Cooley, and Rory McCune, worked on analyzing and addressing the vulnerability (GitHub Advisory).