Log in Start free

Vulnerability · Published Aug 24, 2022 · Assigned by redhat

CVE-2021-4122

Medium 4.3

In plain English

A medium-severity insufficient verification of data authenticity in cryptsetup. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)4.3Medium
Exploit odds (30 days)0.3%top 75.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8cryptsetup-devel2.3.3-4.el8_5.1ALSA-2022:0370
Alpine:v3.20cryptsetup2.4.3-r0ALPINE-CVE-2021-4122
Alpine:v3.21cryptsetup2.4.3-r0ALPINE-CVE-2021-4122
Alpine:v3.22cryptsetup2.4.3-r0ALPINE-CVE-2021-4122
Alpine:v3.23cryptsetup2.4.3-r0ALPINE-CVE-2021-4122
Alpine:v3.24cryptsetup2.4.3-r0ALPINE-CVE-2021-4122
Debian:12cryptsetup2:2.4.3-1DEBIAN-CVE-2021-4122
Debian:13cryptsetup2:2.4.3-1DEBIAN-CVE-2021-4122
Debian:14cryptsetup2:2.4.3-1DEBIAN-CVE-2021-4122
Rocky Linux:8cryptsetup0:2.3.3-4.el8_5.1RLSA-2022:0370
Ubuntu:22.04:LTScryptsetup2:2.4.3-1ubuntu1UBUNTU-CVE-2021-4122

Affected products (as reported)

VendorProductVersions
n/a cryptsetup Fixed in cryptsetup 2.4.3, cryptsetup 2.3.7

Weakness: CWE-345

References