privilege escalation in Moby

Docker's user namespace remapping feature (--userns-remap) has a flaw where a remapped root user can gain real root privileges on the host by modifying files in the Docker directory. This is serious because it defeats the security isolation that this feature is supposed to provide.

The vulnerability exists in Docker's user namespace remapping implementation where a remapped root user with host filesystem access can escalate privileges to real root by manipulating files in /var/lib/docker/<remapping>. The attack requires the --userns-remap option to be enabled and the remapped user to have host filesystem access. Patches in versions 20.10.3 and 19.03.15 restrict privilege escalation vectors from the remapped namespace.