Medium severity · published Jan 23, 2017
CVE-2016-4484
The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via many log in attempts with an invalid…
6.8
CVSS
0.7%
EPSS
No
On KEV
Description
The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via many log in attempts with an invalid password.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
Cryptsetup · Cryptsetup Project
through 2.1.7.3-2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-4484
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-4484
Exploit
http://hmarco.org/bugs/CVE-2016-4484/CVE-2016-4484_cryptsetup_initrd_shell.html
Mailing List
http://www.openwall.com/lists/oss-security/2016/11/14/13
Mailing List
http://www.openwall.com/lists/oss-security/2016/11/15/1
Mailing List
http://www.openwall.com/lists/oss-security/2016/11/15/4
Mailing List
http://www.openwall.com/lists/oss-security/2016/11/16/6
www.securityfocus.com
http://www.securityfocus.com/bid/94315
More from Cryptsetup
7.8
CVE-2020-14382
A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting…
4.3
CVE-2021-4122
It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device