Ubuntu update for cryptsetup
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2021-4122 |
| CWE-ID | CWE-345 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Ubuntu Operating systems & Components / Operating system cryptsetup (Ubuntu package) Operating systems & Components / Operating system package or component |
| Vendor | Canonical Ltd. |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
1) Insufficient verification of data authenticity
EUVDB-ID: #VU63770
Risk: Medium
CVSSv3.1: 5.2 [CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-4122
CWE-ID:
CWE-345 - Insufficient Verification of Data Authenticity
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to escalate privileges on the system.
The vulnerability exists due to improper handling of the LUKS2 reencryption recover. A local attacker with physical access to the medium can send a specially crafted LUKS header and trick cryptsetup into disabling encryption during the recovery of the device.
Update the affected package cryptsetup to the latest version.
Vulnerable software versionsUbuntu: 20.04 - 21.10
cryptsetup (Ubuntu package): before 2:2.3.7-0ubuntu0.21.10.1
CPE2.3 External linkshttp://ubuntu.com/security/notices/USN-5286-1
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
