openEuler update for cryptsetup

1) Insufficient verification of data authenticity

EUVDB-ID: #VU63770

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-4122

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to improper handling of the LUKS2 reencryption recover. A local attacker with physical access to the medium can send a specially crafted LUKS header and trick cryptsetup into disabling encryption during the recovery of the device.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP3

cryptsetup-help: before 2.3.3-6

cryptsetup-debuginfo: before 2.3.3-6

cryptsetup-devel: before 2.3.3-6

veritysetup: before 2.3.3-6

cryptsetup-reencrypt: before 2.3.3-6

cryptsetup-debugsource: before 2.3.3-6

integritysetup: before 2.3.3-6

cryptsetup: before 2.3.3-6

CPE2.3

• cpe:2.3:o:openeuler:openeuler:20.03:LTS SP3:*:*:*:*:*:
• cpe:2.3:o:openeuler:openeuler:20.03:LTS SP2:*:*:*:*:*:
• cpe:2.3:o:openeuler:openeuler:20.03:LTS SP1:*:*:*:*:*:

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1532

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.