CVE-2021-4122
MEDIUMcryptsetup < 2.3.7 - Insufficient Verification of Data Authenticity in LUKS Header
Title source: llmDescription
It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.
References (5)
Core 5
Core References
Permissions Required, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=2031859
Release Notes, Vendor Advisory x_refsource_misc
https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.4/v2.4.3-ReleaseNotes
Patch, Third Party Advisory x_refsource_misc
https://gitlab.com/cryptsetup/cryptsetup/-/commit/0113ac2d889c5322659ad0596d4cfc6da53e356c
Issue Tracking, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=2032401
Third Party Advisory x_refsource_misc
https://access.redhat.com/security/cve/CVE-2021-4122
Scores
CVSS v3
4.3
EPSS
0.0010
EPSS Percentile
28.0%
Attack Vector
PHYSICAL
CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Details
CWE
CWE-345
Status
published
Products (1)
cryptsetup_project/cryptsetup
< 2.3.7
Published
Aug 24, 2022
Tracked Since
Feb 18, 2026