PT-2022-11374 · Unknown+10 · Cryptsetup+10
Milan Broz
·
Published
2021-06-13
·
Updated
2025-10-27
·
CVE-2021-4122
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
cryptsetup versions 2.2.0 through 2.3.6
cryptsetup versions 2.4.0 through 2.4.2
Description
A flaw was found in cryptsetup that could allow an attacker with physical access to a medium, such as a flash disk, to trick the system into disabling encryption during device recovery. This could force a user into permanently disabling the encryption layer of the medium. The issue is related to the modification of LUKS2 metadata, which can be altered without knowing the encryption key, allowing an attacker to simulate a previously started decryption process and leave some decrypted data in plaintext.
Recommendations
For cryptsetup versions 2.2.0 through 2.3.6, update to version 2.3.7 or later.
For cryptsetup versions 2.4.0 through 2.4.2, update to version 2.4.3 or later.
As a temporary workaround, consider using
luksDump to monitor for potential attacks and restrict physical access to encrypted media to minimize the risk of exploitation.Fix
Insufficient Verification of Data Authenticity
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Cryptsetup