CVE-2021-4122
First published: Tue Dec 14 2021(Updated: )
It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cryptsetup Project Cryptsetup | <2.3.7 | |
| Cryptsetup Project Cryptsetup | >=2.4.0<2.4.3 | |
| redhat/cryptsetup | <2.4.3 | 2.4.3 |
| redhat/cryptsetup | <2.3.7 | 2.3.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2021-4122
- https://bugzilla.redhat.com/show_bug.cgi?id=2031859
- https://bugzilla.redhat.com/show_bug.cgi?id=2032401
- https://gitlab.com/cryptsetup/cryptsetup/-/commit/0113ac2d889c5322659ad0596d4cfc6da53e356c
- https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.4/v2.4.3-ReleaseNotes
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2040194
- https://access.redhat.com/errata/RHSA-2022:0370
- https://access.redhat.com/security/cve/cve-2021-4122
Frequently Asked Questions
What is CVE-2021-4122 vulnerability?
CVE-2021-4122 is a vulnerability found in cryptsetup that allows an attacker with physical access to a device to disable encryption.
How does CVE-2021-4122 work?
A specially crafted LUKS header can trick cryptsetup into disabling encryption during device recovery.
What is the severity of CVE-2021-4122?
CVE-2021-4122 has a severity rating of medium with a CVSS score of 4.3.
Which software versions are affected by CVE-2021-4122?
Versions up to and including cryptsetup 2.3.7 and versions between 2.4.0 and 2.4.3 are affected.
How can I fix CVE-2021-4122?
Update cryptsetup to version 2.4.3 or 2.3.7 depending on the currently installed version.
- collector/nvd-index
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/type
- agent/remedy
- agent/author
- agent/weakness
- agent/references
- agent/severity
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-4122
- agent/software-canonical-lookup
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/cryptsetup project
- canonical/cryptsetup project cryptsetup
- version/cryptsetup project cryptsetup/2.4.0
- package-manager/redhat