It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cryptsetup | Cryptsetup_project | * | 2.3.7 (excluding) |
| Cryptsetup | Cryptsetup_project | 2.4.0 (including) | 2.4.3 (excluding) |