It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cryptsetup | Cryptsetup_project | * | 2.3.7 (excluding) |
| Cryptsetup | Cryptsetup_project | 2.4.0 (including) | 2.4.3 (excluding) |
| Red Hat Enterprise Linux 8 | RedHat | cryptsetup-0:2.3.3-4.el8_5.1 | * |
| Red Hat Enterprise Linux 8 | RedHat | cryptsetup-0:2.3.3-4.el8_5.1 | * |
| Cryptsetup | Ubuntu | devel | * |
| Cryptsetup | Ubuntu | focal | * |
| Cryptsetup | Ubuntu | hirsute | * |
| Cryptsetup | Ubuntu | impish | * |
| Cryptsetup | Ubuntu | jammy | * |
| Cryptsetup | Ubuntu | upstream | * |