Log in Start free

Vulnerability · Published Sep 16, 2020 · Assigned by redhat

CVE-2020-14382

High 7.8

In plain English

A high-severity security flaw in cryptsetup. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)1.2%top 32.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement "intervals = malloc(first_backup * sizeof(*intervals));"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20cryptsetup2.3.4-r0ALPINE-CVE-2020-14382
Alpine:v3.21cryptsetup2.3.4-r0ALPINE-CVE-2020-14382
Alpine:v3.22cryptsetup2.3.4-r0ALPINE-CVE-2020-14382
Alpine:v3.23cryptsetup2.3.4-r0ALPINE-CVE-2020-14382
Alpine:v3.24cryptsetup2.3.4-r0ALPINE-CVE-2020-14382
Debian:12cryptsetup2:2.3.4-1DEBIAN-CVE-2020-14382
Debian:13cryptsetup2:2.3.4-1DEBIAN-CVE-2020-14382
Debian:14cryptsetup2:2.3.4-1DEBIAN-CVE-2020-14382

Affected products (as reported)

VendorProductVersions
n/a cryptsetup cryptsetup-2.2.0

References