CVE-2021-4122

CVE-2021-4122 affects cryptsetup’s LUKS2 online reencryption feature. An attacker with repeated physical access can modify on-disk metadata to simulate decryption in progress, potentially decrypting portions of the LUKS2 device and compromising data. Debian confirms impact on LUKS2 (LUKS1 affecte...

CVE-2020-14382

CVE-2020-14382 affects cryptsetup 2.2.0 where LUKS2 header validation in lib/luks2/luks2_json_metadata.c hdr_validate_segments may overflow memory allocation for intervals due to missing overflow checks in intervals = malloc(first_backup * sizeof(*intervals)). This can allow reading data from a c...

CVE-2016-4484

CVE-2016-4484 affects the Debian cryptsetup initrd script (versions up to 2:1.7.3-2). The root cause is that the initrd script allows physically proximate attackers to gain shell access after many login attempts with invalid passwords. The issue provides a high impact on confidentiality, integrit...