CVE-2021-4122

Publication date 13 January 2022

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
cryptsetup	22.04 LTS jammy	Fixed 2:2.4.3-1ubuntu1
	21.10 impish	Fixed 2:2.3.7-0ubuntu0.21.10.1
	21.04 hirsute	Ignored end of life
	20.04 LTS focal	Fixed 2:2.2.2-3ubuntu2.4
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected

Notes

alexmurray

Vulnerability is in the online re-encryption feature which is only supported by cryptsetup >= 2.2.0

mdeslaur

per upstream, the backport to 2.2 would be very problematic and it is suggested that the best option is to disable online reencryption

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
cryptsetup	Upstream: 0113ac2 Upstream: de98f01 Upstream: 60addcf Upstream: 0fd1c62

Severity score breakdown

Parameter	Value
Base score	5.9 · Medium
Attack vector	Physical
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	None
Vector	CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

Related Ubuntu Security Notices (USN)

USN-5286-1
cryptsetup vulnerability
15 February 2022