{"id":"CVE-2021-4122","aliases":["ALPINE-CVE-2021-4122","ALSA-2022:0370","BELL-CVE-2021-4122","CLSA-2022-1643914390","CLSA-2022-1643917881","DEBIAN-CVE-2021-4122","DSA-5070-1","EUVD-2021-33997","GHSA-8fgw-wvm8-3x84","MGASA-2022-0047","OESA-2022-1532","RHSA-2022:0370","RLSA-2022:0370","SUSE-SU-2022:0144-1","UBUNTU-CVE-2021-4122","USN-5286-1","openSUSE-SU-2022:0144-1","openSUSE-SU-2024:11754-1"],"status":"published","title":"It was found that a specially crafted LUKS header could trick cryptsetup into disabling...","description":"It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00319,"percentile":0.25148,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-345"],"published":"2022-01-13T00:00:00Z","modified":"2026-10-29T11:00:37Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"cryptsetup","fixed_in":["2.3.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"cryptsetup","fixed_in":["2.3.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"cryptsetup","fixed_in":["2.3.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"cryptsetup","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"cryptsetup","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"cryptsetup","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"cryptsetup","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"cryptsetup","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"cryptsetup","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"cryptsetup","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"cryptsetup","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"cryptsetup","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"cryptsetup","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"cryptsetup-devel","fixed_in":["2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"cryptsetup","fixed_in":["2.3.3-4.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"cryptsetup-devel","fixed_in":["2.3.3-4.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"cryptsetup-libs","fixed_in":["2.3.3-4.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"cryptsetup-reencrypt","fixed_in":["2.3.3-4.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"integritysetup","fixed_in":["2.3.3-4.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"veritysetup","fixed_in":["2.3.3-4.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"cryptsetup","fixed_in":["2.3.3-4.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"cryptsetup-devel","fixed_in":["2.3.3-4.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"cryptsetup-libs","fixed_in":["2.3.3-4.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"cryptsetup-reencrypt","fixed_in":["2.3.3-4.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"integritysetup","fixed_in":["2.3.3-4.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"veritysetup","fixed_in":["2.3.3-4.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cryptsetup","fixed_in":["2:2.4.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cryptsetup","fixed_in":["2:2.4.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cryptsetup","fixed_in":["2:2.4.3-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"cryptsetup","fixed_in":["2:2.3.7-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"cryptsetup","fixed_in":["2.3.7-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"cryptsetup","fixed_in":["2.3.3-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"cryptsetup","fixed_in":["2.3.3-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"cryptsetup","fixed_in":["2.3.3-6.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-debuginfo","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-debugsource","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-devel","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-libs-debuginfo","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-reencrypt-debuginfo","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"integritysetup-debuginfo","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"veritysetup-debuginfo","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-debuginfo","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-debugsource","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-libs","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-libs-debuginfo","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-reencrypt","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-reencrypt-debuginfo","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"integritysetup","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"integritysetup-debuginfo","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"veritysetup","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"veritysetup-debuginfo","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"cryptsetup","fixed_in":["0:2.3.3-4.el8_5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"cryptsetup","fixed_in":["2.3.7-150300.3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"cryptsetup","fixed_in":["2.3.7-150300.3.5.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"cryptsetup","fixed_in":["2:2.2.2-3ubuntu2.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"cryptsetup","fixed_in":["2:2.4.3-1ubuntu1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"varnish","fixed_in":["7.1.0-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"varnish","fixed_in":["7.1.0-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"cryptsetup","fixed_in":["2.3.7-150300.3.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cryptsetup","fixed_in":["2.4.3-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.3.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.3.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.3.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cryptsetup-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"cryptsetup-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"cryptsetup-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"cryptsetup-reencrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"integritysetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"veritysetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"cryptsetup-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"cryptsetup-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"cryptsetup-reencrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"integritysetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"veritysetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-4.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.3-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.7-1+deb11u1"}]}],"versions":["2:2.3.5-1","2:2.3.5-1+exp1","2:2.3.6-1+exp1","2:2.3.7-1+deb11u1~bpo10+1"]},{"source":"osv","ecosystem":"Mageia:8","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.7-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-6.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cryptsetup-reencrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"integritysetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"veritysetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-reencrypt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cryptsetup-reencrypt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"integritysetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"integritysetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"veritysetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"veritysetup-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-4.el8_5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.7-150300.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.7-150300.3.5.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.2-3ubuntu2.4"}]}],"versions":["2:2.2.0-3ubuntu1","2:2.2.1-1ubuntu1","2:2.2.2-1ubuntu1","2:2.2.2-2ubuntu1","2:2.2.2-3ubuntu1","2:2.2.2-3ubuntu2","2:2.2.2-3ubuntu2.2","2:2.2.2-3ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.4.3-1ubuntu1"}]}],"versions":["2:2.3.6-0ubuntu1","2:2.4.2-1ubuntu3","2:2.4.2-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.2-3ubuntu2.4"}]}],"versions":["2:2.2.0-3ubuntu1","2:2.2.1-1ubuntu1","2:2.2.2-1ubuntu1","2:2.2.2-2ubuntu1","2:2.2.2-3ubuntu1","2:2.2.2-3ubuntu2","2:2.2.2-3ubuntu2.2","2:2.2.2-3ubuntu2.3"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.7-150300.3.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-1.1"}]}]}],"products":[{"vendor":"cryptsetup_project","product":"cryptsetup"},{"vendor":"microsoft","product":"cryptsetup"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2031859","tags":["x_refsource_MISC","x_transferred","Permissions Required","Third Party Advisory","report"]},{"url":"https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.4/v2.4.3-ReleaseNotes","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","article"]},{"url":"https://gitlab.com/cryptsetup/cryptsetup/-/commit/0113ac2d889c5322659ad0596d4cfc6da53e356c","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2032401","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-4122","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4122","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8fgw-wvm8-3x84"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-4122","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-4122","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-4122","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2022-1643914390.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1643917881.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-4122","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0047.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29884","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2022/01/13/2","tags":["web","report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1532","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0370","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0370.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-4122","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2022:0370","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220144-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194469","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4122","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-4122","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5286-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ILTMKWZNQBSX2H2MPF3XKXVDEDPDYAIB/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-4122","description":"It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.","status":"published","published":"2022-08-24T15:08:58Z","modified":"2026-10-14T10:04:04.609Z","cwes":["CWE-345"],"updated_at":"2026-11-02T14:33:07.697752Z"}],"euvd":[{"id":"EUVD-2021-33997","description":"It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.","status":"published","published":"2022-08-24T15:08:58Z","modified":"2026-10-14T10:04:04Z","updated_at":"2026-11-02T17:27:16.85534Z"}],"ghsa":[{"id":"GHSA-8fgw-wvm8-3x84","title":"It was found that a specially crafted LUKS header could trick cryptsetup into disabling...","description":"It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.","status":"published","published":"2022-08-25T00:00:27Z","modified":"2026-10-14T12:31:25Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T15:13:24.188405Z"}],"nvd":[{"id":"CVE-2021-4122","description":"It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.","status":"published","published":"2022-08-24T16:15:09.427Z","modified":"2026-10-14T11:16:54.753Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"ALPINE-CVE-2021-4122","description":"It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.","status":"published","published":"2022-08-24T16:15:09.427Z","modified":"2026-10-23T17:17:56.213888725Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"BELL-CVE-2021-4122","title":"CVE-2021-4122 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:29.126663Z","modified":"2026-01-26T09:49:22.337429Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-4122","description":"It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.","status":"published","published":"2022-08-24T16:15:09.427Z","modified":"2026-10-20T14:06:39.286020908Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:21.249056Z"},{"id":"DEBIAN-CVE-2021-4122","description":"It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.","status":"published","published":"2022-08-24T16:15:09.427Z","modified":"2026-10-15T09:47:34.766218542Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"OESA-2022-1532","title":"cryptsetup security update","description":"cryptsetup is a utility used to conveniently set up disk encryption based on the DMCrypt kernel module.\r\n\r\nSecurity Fix(es):\r\n\r\nIt was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.(CVE-2021-4122)","status":"published","published":"2022-02-19T11:04:48Z","modified":"2026-08-18T01:15:39.476747579Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2022:0370","title":"Red Hat Security Advisory: cryptsetup security update","status":"published","published":"2024-09-16T07:07:21Z","modified":"2026-10-15T10:02:12Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RLSA-2022:0370","title":"Moderate: cryptsetup security update","description":"The cryptsetup packages provide a utility for setting up disk encryption using the dm-crypt kernel module.\n\nSecurity Fix(es):\n\n* cryptsetup: disable encryption via header rewrite (CVE-2021-4122)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-02-01T20:13:30Z","modified":"2026-02-04T18:15:09.751032Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-4122","description":"It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.","status":"published","published":"2022-01-13T00:00:00Z","modified":"2026-04-22T13:01:09.322651Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"ALSA-2022:0370","title":"Moderate: cryptsetup security update","description":"The cryptsetup packages provide a utility for setting up disk encryption using the dm-crypt kernel module.\n\nSecurity Fix(es):\n\n* cryptsetup: disable encryption via header rewrite (CVE-2021-4122)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-02-01T20:13:30Z","modified":"2026-10-29T11:00:37.701690711Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2022-1643914390","title":"Fix of CVE: CVE-2021-4122","description":"- CVE-2021-4122: fix possible attacks against data confidentiality\n  through LUKS2 online reencryption extension crash recovery.","status":"published","published":"2022-02-03T18:53:10Z","modified":"2026-06-01T00:33:19.384269405Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2022-1643917881","title":"Fix of CVE: CVE-2021-4122","description":"- CVE-2021-4122: fix possible attacks against data confidentiality\n  through LUKS2 online reencryption extension crash recovery.","status":"published","published":"2022-02-03T19:51:21Z","modified":"2026-06-01T00:33:19.129875208Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"DSA-5070-1","title":"cryptsetup - security update","status":"published","published":"2022-02-10T00:00:00Z","modified":"2026-03-09T02:09:59.151665Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0047","title":"Updated cryptsetup packages fix security vulnerability","description":"An attacker can modify on-disk metadata to simulate decryption in progress\nwith crashed (unfinished) reencryption step and persistently decrypt part\nof the LUKS device (CVE-2021-4122).\n","status":"published","published":"2022-02-03T20:29:44Z","modified":"2026-04-16T04:42:00.705977185Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0144-1","title":"Security update for cryptsetup","description":"This update for cryptsetup fixes the following issues:\n\n- CVE-2021-4122: Fixed possible attacks against data confidentiality through LUKS2 online reencryption extension crash recovery (bsc#1194469).\n","status":"published","published":"2022-01-20T15:38:27Z","modified":"2026-02-04T04:23:20.726856Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11754-1","title":"cryptsetup-2.4.3-1.1 on GA media","description":"These are all security issues fixed in the cryptsetup-2.4.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:25:20.736234Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2022:0144-1","title":"Security update for cryptsetup","description":"This update for cryptsetup fixes the following issues:\n\n- CVE-2021-4122: Fixed possible attacks against data confidentiality through LUKS2 online reencryption extension crash recovery (bsc#1194469).\n","status":"published","published":"2022-01-20T15:38:30Z","modified":"2026-02-04T02:32:04.393369Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"USN-5286-1","title":"cryptsetup vulnerability","description":"Milan Broz discovered that cryptsetup incorrectly handled LUKS2\nreencryption recovery. An attacker with physical access to modify the\nencrypted device header may trigger the device to be unencrypted the next\ntime it is mounted by the user.\n\nOn Ubuntu 20.04 LTS, this issue was fixed by disabling the online\nreencryption feature.\n","status":"published","published":"2022-02-15T15:20:44Z","modified":"2026-04-22T10:20:48.304196Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}