CVE-2021-4122 is a medium-severity vulnerability affecting cryptsetup_project cryptsetup, where a specially crafted LUKS header can trick the software into disabling encryption during device recovery. An attacker with physical access to the storage medium could exploit this flaw to permanently disable its encryption layer, leading to a high impact on integrity but no confidentiality or availability impact. The attack requires physical access and user interaction, making it less complex to execute. There is no evidence of active exploitation, and no public exploit code is available, though it has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.3.7CPE matchmatch criteria | cpe:2.3:a:cryptsetup_project:cryptsetup:*:*:*:*:*:*:*:* | ||
>= 2.4.0, < 2.4.3CPE matchmatch criteria | cpe:2.3:a:cryptsetup_project:cryptsetup:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.0 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium such as a flash disk could use this flaw to force a user into permanently disabling the encryption layer of that medium.
Aug 9, 2022cryptsetup: disable encryption via header rewrite
Jan 13, 2022