REDHAT-BUG-2554026: Medium severity Red Hat luksmeta vulnerability
A flaw was found in luksmeta. The readheader() function validates occupied slot offsets and lengths separately without ensuring that each complete range remains within the LUKS1 metadata gap. A crafted header with a valid CRC32C checksum can therefore direct subsequent luksmetaload() or luksmetawipe() operations outside the intended metadata area on the same opened device or image. The wipe operation can zero encrypted payload data, potentially causing persistent data loss or making filesystem contents inaccessible. A wrapping slot endpoint can also misposition the subsequent metadata-header rewrite. Exploitation on a deployed block device normally requires root or equivalent raw write access, which already permits direct storage corruption and substantially limits the additional capability gained. The command-line load path suppresses output when the data CRC check fails; no incremental confidentiality impact or privilege escalation has been established. Source review confirms that this parser defect remains after the allocator fix for CVE-2026-107565. The reviewed code path explicitly rejects LUKS2 devices.
Affected Software
Event History
Frequently Asked Questions
Which devices and formats are affected by this issue?
The reviewed code path applies to LUKS1 metadata handling and explicitly rejects LUKS2 devices. The risk arises when luksmeta processes a crafted header on an opened LUKS1 device or image.
What access would an attacker need to exploit the flaw on a deployed system?
Exploitation normally requires root privileges or equivalent raw write access to the block device. That level of access already allows direct storage corruption, so the issue adds limited capability in that scenario.
What is the practical impact of a successful exploit?
A crafted, CRC32C-valid header can cause luksmeta_load() or luksmeta_wipe() to operate outside the intended metadata area. In particular, wipe operations can zero encrypted payload data, causing persistent data loss or making filesystem contents inaccessible; a wrapping slot endpoint can also misplace a metadata-header rewrite.
Is there a known confidentiality or privilege-escalation impact?
No incremental confidentiality impact or privilege escalation has been established. The command-line load path suppresses output if the data CRC check fails.