CVE-2020-14382 Integer overflow in cryptsetup

High 7.8 Published 16 Sep 2020 Updated 4 Aug 2024

An integer overflow in cryptsetup's LUKS2 validation allows attackers to cause memory corruption via crafted images, potentially leading to code execution or crashes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2020-14382?

CVE-2020-14382 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 16 Sep 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement "intervals = malloc(first_backup * sizeof(*intervals));"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.

Weakness: CWE-787

Which versions are affected by CVE-2020-14382?

It affects 4 products.

Linux distribution packages (40)

`cryptsetup-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.3.3-2.el8`
`cryptsetup-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.3.3-2.el8`
`cryptsetup-devel` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.3.3-2.el8`
`cryptsetup-libs-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.3.3-2.el8`
`cryptsetup-reencrypt-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.3.3-2.el8`
`integritysetup-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.3.3-2.el8`
`veritysetup-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.3.3-2.el8`
`cryptsetup` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-2.el8`
`cryptsetup-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-2.el8`
`cryptsetup-debugsource` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-2.el8`
`cryptsetup-libs` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-2.el8`
`cryptsetup-libs-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-2.el8`
`cryptsetup-reencrypt` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-2.el8`
`cryptsetup-reencrypt-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-2.el8`
`integritysetup` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-2.el8`
`integritysetup-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-2.el8`
`veritysetup` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-2.el8`
`veritysetup-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-2.el8`
`cryptsetup-debuginfo` Red Hat:rhel_eus:8.1::appstream	All versions	`0:2.2.0-2.el8_1.1`
`cryptsetup-debugsource` Red Hat:rhel_eus:8.1::appstream	All versions	`0:2.2.0-2.el8_1.1`
`cryptsetup-devel` Red Hat:rhel_eus:8.1::appstream	All versions	`0:2.2.0-2.el8_1.1`
`cryptsetup-libs-debuginfo` Red Hat:rhel_eus:8.1::appstream	All versions	`0:2.2.0-2.el8_1.1`
`cryptsetup-reencrypt-debuginfo` Red Hat:rhel_eus:8.1::appstream	All versions	`0:2.2.0-2.el8_1.1`
`integritysetup-debuginfo` Red Hat:rhel_eus:8.1::appstream	All versions	`0:2.2.0-2.el8_1.1`
`veritysetup-debuginfo` Red Hat:rhel_eus:8.1::appstream	All versions	`0:2.2.0-2.el8_1.1`
`cryptsetup` Red Hat:rhel_eus:8.1::baseos	All versions	`0:2.2.0-2.el8_1.1`
`cryptsetup-debuginfo` Red Hat:rhel_eus:8.1::baseos	All versions	`0:2.2.0-2.el8_1.1`
`cryptsetup-debugsource` Red Hat:rhel_eus:8.1::baseos	All versions	`0:2.2.0-2.el8_1.1`
`cryptsetup-libs` Red Hat:rhel_eus:8.1::baseos	All versions	`0:2.2.0-2.el8_1.1`
`cryptsetup-libs-debuginfo` Red Hat:rhel_eus:8.1::baseos	All versions	`0:2.2.0-2.el8_1.1`
`cryptsetup-reencrypt` Red Hat:rhel_eus:8.1::baseos	All versions	`0:2.2.0-2.el8_1.1`
`cryptsetup-reencrypt-debuginfo` Red Hat:rhel_eus:8.1::baseos	All versions	`0:2.2.0-2.el8_1.1`
`integritysetup` Red Hat:rhel_eus:8.1::baseos	All versions	`0:2.2.0-2.el8_1.1`
`integritysetup-debuginfo` Red Hat:rhel_eus:8.1::baseos	All versions	`0:2.2.0-2.el8_1.1`
`veritysetup` Red Hat:rhel_eus:8.1::baseos	All versions	`0:2.2.0-2.el8_1.1`
`veritysetup-debuginfo` Red Hat:rhel_eus:8.1::baseos	All versions	`0:2.2.0-2.el8_1.1`
`cryptsetup-debuginfo` Red Hat:rhel_eus:8.2::appstream	All versions	`0:2.2.2-1.el8_2.1`
`cryptsetup-debugsource` Red Hat:rhel_eus:8.2::appstream	All versions	`0:2.2.2-1.el8_2.1`
`cryptsetup-devel` Red Hat:rhel_eus:8.2::appstream	All versions	`0:2.2.2-1.el8_2.1`
`cryptsetup-libs-debuginfo` Red Hat:rhel_eus:8.2::appstream	All versions	`0:2.2.2-1.el8_2.1`

Products include Canonical Ubuntu Linux, Cryptsetup Project Cryptsetup, Fedoraproject Fedora, Redhat Enterprise Linux.

How do I fix CVE-2020-14382?

Apply the vendor's patch.

Is CVE-2020-14382 being exploited?

There is no known exploitation of CVE-2020-14382 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2020-14382, DEBIAN-CVE-2020-14382, GHSA-v8mw-xqhr-2vqp, RHSA-2020:4542, RHSA-2020:4900, RHSA-2021:0258 and 3 more.