Host permission widening via docker cp

Improper permission preservation in Moby before 20.10.9 allows local users to widen host file access via docker cp into a crafted container. The chrootarchive untarHandler created parent directories outside the intended chroot and applied ownership and mode changes to existing host paths. Exploitation requires Docker control of a specially crafted container; the flaw widens permissions but does not itself read, modify, or execute file contents without a cooperating process.