Cryptsetup is a utility for managing encrypted volumes and block devices on Linux systems, with vulnerability exposure concentrated in its core cryptsetup product around authentication and data-integrity mechanisms. The observed weakness classes—improper authentication, insufficient verification of data authenticity, and out-of-bounds writes—reflect the cryptographic and kernel-interface demands of a full-disk encryption implementation; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Cryptsetup Project over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-4484MEDIUM The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via many log in attempts with an invalid passwo | Jan 23, 2017 | 6.8 | 26 | NO | NO |
CVE-2020-14382HIGH A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting it | Sep 16, 2020 | 7.8 | 25 | NO | NO |
CVE-2021-4122MEDIUM It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium | Aug 24, 2022 | 4.3 | 19 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Cryptsetup Project.
Media articles that mention a CVE ID that affects a product developed by Cryptsetup Project — matched by CVE ID, not by vendor name.