Every CVE Search/ Get API key

CVE-2021-4122

It was found that a specially crafted LUKS header could trick cryptsetup into disabling...

4.3 MediumFix available

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

Attack profile

How easy it is to exploit

Attack vector
Physical
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.32%Down 0.6 points since Aug 25, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

Record
CVE-2021-4122
CVSS 3.1
4.3 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness
CWE-345
Updated
2026-11-02
CVE List No score

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

Record
CVE-2021-4122
Weakness
CWE-345
Updated
2026-11-02
EUVDEUVD-2021-33997 No score

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

Record
EUVD-2021-33997
Updated
2026-11-02
GitHub AdvisoriesGHSA-8fgw-wvm8-3x84 4.3

It was found that a specially crafted LUKS header could trick cryptsetup into disabling...

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

Record
GHSA-8fgw-wvm8-3x84
CVSS 3.1
4.3 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness
CWE-345
Updated
2026-11-02
OSVALPINE-CVE-2021-4122 4.3

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

Record
ALPINE-CVE-2021-4122
CVSS 3.1
4.3 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVBELL-CVE-2021-4122 4.3

CVE-2021-4122 does not affect BellSoft software

Record
BELL-CVE-2021-4122
CVSS 3.1
4.3 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 14 moreShow less
OSV 4.3

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

Record
CVE-2021-4122
CVSS 3.1
4.3 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2021-4122 4.3

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

Record
DEBIAN-CVE-2021-4122
CVSS 3.1
4.3 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2022-1532 5.9

cryptsetup security update

cryptsetup is a utility used to conveniently set up disk encryption based on the DMCrypt kernel module.

Security Fix(es):

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.(CVE-2021-4122)

Record
OESA-2022-1532
CVSS 3.1
5.9 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2022:0370 5.9

Red Hat Security Advisory: cryptsetup security update

Record
RHSA-2022:0370
CVSS 3.1
5.9 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2022:0370 5.9

Moderate: cryptsetup security update

The cryptsetup packages provide a utility for setting up disk encryption using the dm-crypt kernel module.

Security Fix(es):

  • cryptsetup: disable encryption via header rewrite (CVE-2021-4122)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2022:0370
CVSS 3.1
5.9 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2021-4122 5.9

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

Record
UBUNTU-CVE-2021-4122
CVSS 3.1
5.9 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVALSA-2022:0370 No score

Moderate: cryptsetup security update

The cryptsetup packages provide a utility for setting up disk encryption using the dm-crypt kernel module.

Security Fix(es):

  • cryptsetup: disable encryption via header rewrite (CVE-2021-4122)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2022:0370
Updated
2026-11-02
OSVCLSA-2022-1643914390 No score

Fix of CVE: CVE-2021-4122

  • CVE-2021-4122: fix possible attacks against data confidentiality through LUKS2 online reencryption extension crash recovery.
Record
CLSA-2022-1643914390
Updated
2026-11-02
OSVCLSA-2022-1643917881 No score

Fix of CVE: CVE-2021-4122

  • CVE-2021-4122: fix possible attacks against data confidentiality through LUKS2 online reencryption extension crash recovery.
Record
CLSA-2022-1643917881
Updated
2026-11-02
OSVMGASA-2022-0047 No score

Updated cryptsetup packages fix security vulnerability

An attacker can modify on-disk metadata to simulate decryption in progress with crashed (unfinished) reencryption step and persistently decrypt part of the LUKS device (CVE-2021-4122).

Record
MGASA-2022-0047
Updated
2026-11-02
OSVopenSUSE-SU-2022:0144-1 No score

Security update for cryptsetup

This update for cryptsetup fixes the following issues:

  • CVE-2021-4122: Fixed possible attacks against data confidentiality through LUKS2 online reencryption extension crash recovery (bsc#1194469).
Record
openSUSE-SU-2022:0144-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11754-1 No score

cryptsetup-2.4.3-1.1 on GA media

These are all security issues fixed in the cryptsetup-2.4.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11754-1
Updated
2026-11-02
OSVSUSE-SU-2022:0144-1 No score

Security update for cryptsetup

This update for cryptsetup fixes the following issues:

  • CVE-2021-4122: Fixed possible attacks against data confidentiality through LUKS2 online reencryption extension crash recovery (bsc#1194469).
Record
SUSE-SU-2022:0144-1
Updated
2026-11-02
OSVUSN-5286-1 No score

cryptsetup vulnerability

Milan Broz discovered that cryptsetup incorrectly handled LUKS2 reencryption recovery. An attacker with physical access to modify the encrypted device header may trigger the device to be unencrypted the next time it is mounted by the user.

On Ubuntu 20.04 LTS, this issue was fixed by disabling the online reencryption feature.

Record
USN-5286-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cryptsetup
Alpine:v3.12
 2.4.0 up to 2.3.7-r0
2.3.7-r0
cryptsetup
Alpine:v3.13
 2.4.0 up to 2.3.7-r0
2.3.7-r0
cryptsetup
Alpine:v3.14
 2.4.0 up to 2.3.7-r0
2.3.7-r0
cryptsetup
Alpine:v3.15
 2.4.0 up to 2.4.3-r0
2.4.3-r0
cryptsetup
Alpine:v3.16
 2.4.0 up to 2.4.3-r0
2.4.3-r0
cryptsetup
Alpine:v3.17
 2.4.0 up to 2.4.3-r0
2.4.3-r0
cryptsetup
Alpine:v3.18
 2.4.0 up to 2.4.3-r0
2.4.3-r0
cryptsetup
Alpine:v3.19
 2.4.0 up to 2.4.3-r0
2.4.3-r0
cryptsetup
Alpine:v3.20
 2.4.0 up to 2.4.3-r0
2.4.3-r0
cryptsetup
Alpine:v3.21
 2.4.0 up to 2.4.3-r0
2.4.3-r0
Show 51 moreShow less
Affected packages
PackageAffectedFixed
cryptsetup
Alpine:v3.22
 2.4.0 up to 2.4.3-r0
2.4.3-r0
cryptsetup
Alpine:v3.23
 2.4.0 up to 2.4.3-r0
2.4.3-r0
cryptsetup
Alpine:v3.24
 2.4.0 up to 2.4.3-r0
2.4.3-r0
cryptsetup-devel
AlmaLinux:8
 before 2.3.3-4.el8_5.1
2.3.3-4.el8_5.1
cryptsetup
TuxCare:CentOS:8.5
 before 2.3.3-4.el8.tuxcare.els1
2.3.3-4.el8.tuxcare.els1
cryptsetup-devel
TuxCare:CentOS:8.5
 before 2.3.3-4.el8.tuxcare.els1
2.3.3-4.el8.tuxcare.els1
cryptsetup-libs
TuxCare:CentOS:8.5
 before 2.3.3-4.el8.tuxcare.els1
2.3.3-4.el8.tuxcare.els1
cryptsetup-reencrypt
TuxCare:CentOS:8.5
 before 2.3.3-4.el8.tuxcare.els1
2.3.3-4.el8.tuxcare.els1
integritysetup
TuxCare:CentOS:8.5
 before 2.3.3-4.el8.tuxcare.els1
2.3.3-4.el8.tuxcare.els1
veritysetup
TuxCare:CentOS:8.5
 before 2.3.3-4.el8.tuxcare.els1
2.3.3-4.el8.tuxcare.els1
cryptsetup
TuxCare:CentOS:8.4
 before 2.3.3-4.el8.tuxcare.els1
2.3.3-4.el8.tuxcare.els1
cryptsetup-devel
TuxCare:CentOS:8.4
 before 2.3.3-4.el8.tuxcare.els1
2.3.3-4.el8.tuxcare.els1
cryptsetup-libs
TuxCare:CentOS:8.4
 before 2.3.3-4.el8.tuxcare.els1
2.3.3-4.el8.tuxcare.els1
cryptsetup-reencrypt
TuxCare:CentOS:8.4
 before 2.3.3-4.el8.tuxcare.els1
2.3.3-4.el8.tuxcare.els1
integritysetup
TuxCare:CentOS:8.4
 before 2.3.3-4.el8.tuxcare.els1
2.3.3-4.el8.tuxcare.els1
veritysetup
TuxCare:CentOS:8.4
 before 2.3.3-4.el8.tuxcare.els1
2.3.3-4.el8.tuxcare.els1
cryptsetup
Debian:12
 before 2:2.4.3-1
2:2.4.3-1
cryptsetup
Debian:13
 before 2:2.4.3-1
2:2.4.3-1
cryptsetup
Debian:14
 before 2:2.4.3-1
2:2.4.3-1
cryptsetup
Debian:11
 before 2:2.3.7-1+deb11u1, plus listed versions
2:2.3.5-12:2.3.5-1+exp12:2.3.6-1+exp12:2.3.7-1+deb11u1~bpo10+1
2:2.3.7-1+deb11u1
cryptsetup
Mageia:8
 before 2.3.7-1.mga8
2.3.7-1.mga8
cryptsetup
openEuler:20.03-LTS-SP1
 before 2.3.3-6.oe1
2.3.3-6.oe1
cryptsetup
openEuler:20.03-LTS-SP2
 before 2.3.3-6.oe1
2.3.3-6.oe1
cryptsetup
openEuler:20.03-LTS-SP3
 before 2.3.3-6.oe1
2.3.3-6.oe1
cryptsetup-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
cryptsetup-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
cryptsetup-devel
Red Hat:enterprise_linux:8::appstream
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
cryptsetup-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
cryptsetup-reencrypt-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
integritysetup-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
veritysetup-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
cryptsetup
Red Hat:enterprise_linux:8::baseos
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
cryptsetup-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
cryptsetup-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
cryptsetup-libs
Red Hat:enterprise_linux:8::baseos
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
cryptsetup-libs-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
cryptsetup-reencrypt
Red Hat:enterprise_linux:8::baseos
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
cryptsetup-reencrypt-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
integritysetup
Red Hat:enterprise_linux:8::baseos
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
integritysetup-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
veritysetup
Red Hat:enterprise_linux:8::baseos
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
veritysetup-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
cryptsetup
Rocky Linux:8
 before 0:2.3.3-4.el8_5.1
0:2.3.3-4.el8_5.1
cryptsetup
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 2.3.7-150300.3.5.1
2.3.7-150300.3.5.1
cryptsetup
SUSE:Linux Enterprise Micro 5.1
 before 2.3.7-150300.3.5.1
2.3.7-150300.3.5.1
cryptsetup
Ubuntu:20.04:LTS
 before 2:2.2.2-3ubuntu2.4, plus listed versions
2:2.2.0-3ubuntu12:2.2.1-1ubuntu12:2.2.2-1ubuntu12:2.2.2-2ubuntu12:2.2.2-3ubuntu12:2.2.2-3ubuntu22:2.2.2-3ubuntu2.22:2.2.2-3ubuntu2.3
2:2.2.2-3ubuntu2.4
cryptsetup
Ubuntu:22.04:LTS
 before 2:2.4.3-1ubuntu1, plus listed versions
2:2.3.6-0ubuntu12:2.4.2-1ubuntu32:2.4.2-1ubuntu4
2:2.4.3-1ubuntu1
varnish
SUSE:Package Hub 15 SP4
 before 7.1.0-bp154.2.3.1
7.1.0-bp154.2.3.1
varnish
openSUSE:Leap 15.4
 before 7.1.0-bp154.2.3.1
7.1.0-bp154.2.3.1
cryptsetup
openSUSE:Leap 15.3
 before 2.3.7-150300.3.5.1
2.3.7-150300.3.5.1
cryptsetup
openSUSE:Tumbleweed
 before 2.4.3-1.1
2.4.3-1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-4122 is a medium vulnerability (CVSS 4.3) in Cryptsetup Project Cryptsetup, published January 13, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in cryptsetup 2.3.7-r0.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open