CVE-2021-4122

MediumCVSS 4.3

Published: 24/08/2022(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

22th percentile - higher than 22% of all known CVEs

Summary

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

Risk Assessment

An attacker with physical access to the medium can cause permanent disabling of encryption, resulting in data exposure. This poses a serious threat to data confidentiality on portable media.

Recommendation

Update cryptsetup to a version containing the fix for CVE-2021-4122. Avoid recovering LUKS devices from untrusted media and verify LUKS header integrity.

Other vulnerabilities in cryptsetup

CVE-2025-58356High
Constellation, the first Confidential Kubernetes, uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted storage device, the CVM uses the libcryptsetup function crypt_activate_by_passphrase. Due to unsafe handling of null keyslot algorithms in cryptsetup 2.8.1, it is possible that the opened volume is not encrypted at all. Cryptsetup prior to 2.8.1 does not report an error when processing LUKS2-formatted disks using the cipher_null-ecb algorithm in the keyslot encryption field. This vulnerability is fixed in 2.24.0.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS