CVE-2021-4122: It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device

Description

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack vector

Physical

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

None

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 25% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

CR

cryptsetup ·

Fixed in cryptsetup 2.4.3, cryptsetup 2.3.7 · source: vendor, NVD

SS

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens

V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA

SS

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens

V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA

SS

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · Siemens

V3.1.0 before V3.1.5 · source: CISA