Amazon Linux AMI update for cryptsetup



Published: 2024-08-06
Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2021-4122
CWE-ID CWE-345
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe 		Amazon Linux AMI
Operating systems & Components / Operating system

cryptsetup
Operating systems & Components / Operating system package or component

Vendor Amazon Web Services

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Insufficient verification of data authenticity

EUVDB-ID: #VU63770

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-4122

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to improper handling of the LUKS2 reencryption recover. A local attacker with physical access to the medium can send a specially crafted LUKS header and trick cryptsetup into disabling encryption during the recovery of the device.

Mitigation

Update the affected packages:

aarch64:
    cryptsetup-ssh-token-debuginfo-2.4.3-2.amzn2023.0.2.aarch64
    veritysetup-debuginfo-2.4.3-2.amzn2023.0.2.aarch64
    integritysetup-debuginfo-2.4.3-2.amzn2023.0.2.aarch64
    cryptsetup-libs-2.4.3-2.amzn2023.0.2.aarch64
    cryptsetup-reencrypt-debuginfo-2.4.3-2.amzn2023.0.2.aarch64
    integritysetup-2.4.3-2.amzn2023.0.2.aarch64
    cryptsetup-devel-2.4.3-2.amzn2023.0.2.aarch64
    veritysetup-2.4.3-2.amzn2023.0.2.aarch64
    cryptsetup-ssh-token-2.4.3-2.amzn2023.0.2.aarch64
    cryptsetup-reencrypt-2.4.3-2.amzn2023.0.2.aarch64
    cryptsetup-debuginfo-2.4.3-2.amzn2023.0.2.aarch64
    cryptsetup-libs-debuginfo-2.4.3-2.amzn2023.0.2.aarch64
    cryptsetup-2.4.3-2.amzn2023.0.2.aarch64
    cryptsetup-debugsource-2.4.3-2.amzn2023.0.2.aarch64

src:
    cryptsetup-2.4.3-2.amzn2023.0.2.src

x86_64:
    cryptsetup-debuginfo-2.4.3-2.amzn2023.0.2.x86_64
    cryptsetup-ssh-token-debuginfo-2.4.3-2.amzn2023.0.2.x86_64
    cryptsetup-libs-2.4.3-2.amzn2023.0.2.x86_64
    cryptsetup-ssh-token-2.4.3-2.amzn2023.0.2.x86_64
    cryptsetup-reencrypt-debuginfo-2.4.3-2.amzn2023.0.2.x86_64
    cryptsetup-libs-debuginfo-2.4.3-2.amzn2023.0.2.x86_64
    cryptsetup-reencrypt-2.4.3-2.amzn2023.0.2.x86_64
    integritysetup-debuginfo-2.4.3-2.amzn2023.0.2.x86_64
    veritysetup-2.4.3-2.amzn2023.0.2.x86_64
    cryptsetup-devel-2.4.3-2.amzn2023.0.2.x86_64
    veritysetup-debuginfo-2.4.3-2.amzn2023.0.2.x86_64
    cryptsetup-2.4.3-2.amzn2023.0.2.x86_64
    cryptsetup-debugsource-2.4.3-2.amzn2023.0.2.x86_64
    integritysetup-2.4.3-2.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

cryptsetup: before 2.4.3-2

CPE2.3 External links

http://alas.aws.amazon.com/AL2023/ALAS-2023-027.html


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###