The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0144-1 advisory.

  - It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during     the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could     use this flaw to force a user into permanently disabling the encryption layer of that medium.
    (CVE-2021-4122)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0370 advisory.

    The cryptsetup packages provide a utility for setting up disk encryption using the dm-crypt kernel module.

    Security Fix(es):

    * cryptsetup: disable encryption via header rewrite (CVE-2021-4122)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-064 advisory.

    It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during     the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could     use this flaw to force a user into permanently disabling the encryption layer of that medium.
    (CVE-2021-4122)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5070 advisory.

    CVE-2021-4122 Milan Broz, its maintainer, discovered an issue in cryptsetup, the disk encryption     configuration tool for Linux. LUKS2 (an on-disk format) online reencryption is an optional extension to     allow a user to change the data reencryption key while the data device is available for use during the     whole reencryption process. An attacker can modify on-disk metadata to simulate decryption in progress     with crashed (unfinished) reencryption step and persistently decrypt part of the LUKS2 device (LUKS1     devices are indirectly affected as well, see below). This attack requires repeated physical access to the     LUKS2 device but no knowledge of user passphrases. The decryption step is performed after a valid user     activates the device with a correct passphrase and modified metadata. The size of possible decrypted data     per attack step depends on configured LUKS2 header size (metadata size is configurable for LUKS2). With     the default LUKS2 parameters (16 MiB header) and only one allocated keyslot (512 bit key for AES-XTS),     simulated decryption with checksum resilience SHA1 (20 bytes checksum for 4096-byte blocks), the maximal     decrypted size can be over 3GiB. The attack is not applicable to LUKS1 format, but the attacker can update     metadata in place to LUKS2 format as an additional step. For such a converted LUKS2 header, the keyslot     area is limited to decrypted size (with SHA1 checksums) over 300 MiB. LUKS devices that were formatted     using a cryptsetup binary from Debian Stretch or earlier are using LUKS1. However since Debian Buster the     default on-disk LUKS format version is LUKS2. In particular, encrypted devices formatted by the Debian     Buster and Bullseye installers are using LUKS2 by default. Key truncation in dm-integrity This update     additionaly fixes a key truncation issue for standalone dm-integrity devices using HMAC integrity     protection. For existing such devices with extra long HMAC keys (typically >106 bytes of length), one     might need to manually truncate the key using integritysetup(8)'s --integrity-key-size option in order to     properly map the device under 2:2.3.7-1+deb11u1 and later. Only standalone dm-integrity devices are     affected. dm-crypt devices, including those using authenticated disk encryption, are unaffected. For the     oldstable distribution (buster), this problem is not present. For the stable distribution (bullseye), this     problem has been fixed in version 2:2.3.7-1+deb11u1. We recommend that you upgrade your cryptsetup     packages. For the detailed security status of cryptsetup please refer to its security tracker page at:
    https://security-tracker.debian.org/tracker/cryptsetup

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2022:0008 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-4122:
    It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during     the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could     use this flaw to force a user into permanently disabling the encryption layer of that medium.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:370 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
156928	SUSE SLED15 / SLES15 Security Update : cryptsetup (SUSE-SU-2022:0144-1)	Nessus	SuSE Local Security Checks	2022/1/21	2023/7/14	medium
157314	RHEL 8 : cryptsetup (RHSA-2022:0370)	Nessus	Red Hat Local Security Checks	2022/2/2	2024/11/8	medium
164725	Amazon Linux 2022 : cryptsetup, cryptsetup-devel, cryptsetup-libs (ALAS2022-2022-064)	Nessus	Amazon Linux Local Security Checks	2022/9/6	2024/12/11	medium
157886	Debian DSA-5070-1 : cryptsetup - security update	Nessus	Debian Local Security Checks	2022/2/11	2025/1/24	medium
236499	Alibaba Cloud Linux 3 : 0008: cryptsetup (ALINUX3-SA-2022:0008)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium
157786	Rocky Linux 8 : cryptsetup (RLSA-2022:370)	Nessus	Rocky Linux Local Security Checks	2022/2/9	2022/12/13	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium