CVE-2021-4122 Security feature bypass in cryptsetup

Medium 4.3 Published 24 Aug 2022 Updated 14 Oct 2026

An attacker with physical access can craft a LUKS header to force cryptsetup to disable encryption, bypassing data protection on the medium.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-4122?

CVE-2021-4122 is a medium-severity vulnerability in cryptsetup, published on 24 Aug 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

Weakness: CWE-345

Which versions are affected by CVE-2021-4122?

It affects 1 product.

Linux distribution packages (26)

`cryptsetup-devel` AlmaLinux:8	All versions	`2.3.3-4.el8_5.1`
`cryptsetup-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.3.3-4.el8_5.1`
`cryptsetup-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.3.3-4.el8_5.1`
`cryptsetup-devel` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.3.3-4.el8_5.1`
`cryptsetup-libs-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.3.3-4.el8_5.1`
`cryptsetup-reencrypt-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.3.3-4.el8_5.1`
`integritysetup-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.3.3-4.el8_5.1`
`veritysetup-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.3.3-4.el8_5.1`
`cryptsetup` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-4.el8_5.1`
`cryptsetup-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-4.el8_5.1`
`cryptsetup-debugsource` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-4.el8_5.1`
`cryptsetup-libs` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-4.el8_5.1`
`cryptsetup-libs-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-4.el8_5.1`
`cryptsetup-reencrypt` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-4.el8_5.1`
`cryptsetup-reencrypt-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-4.el8_5.1`
`integritysetup` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-4.el8_5.1`
`integritysetup-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-4.el8_5.1`
`veritysetup` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-4.el8_5.1`
`veritysetup-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.3.3-4.el8_5.1`
`cryptsetup` Rocky Linux:8	All versions	`0:2.3.3-4.el8_5.1`
`cryptsetup` SUSE:Linux Enterprise Micro 5.1	All versions	`2.3.7-150300.3.5.1`
`cryptsetup` SUSE:Linux Enterprise Module for Basesystem 15 SP3	All versions	`2.3.7-150300.3.5.1`
`varnish` SUSE:Package Hub 15 SP4	All versions	`7.1.0-bp154.2.3.1`
`cryptsetup` openSUSE:Leap 15.3	All versions	`2.3.7-150300.3.5.1`
`varnish` openSUSE:Leap 15.4	All versions	`7.1.0-bp154.2.3.1`
`cryptsetup` openSUSE:Tumbleweed	All versions	`2.4.3-1.1`

Products include Cryptsetup Project Cryptsetup.

How do I fix CVE-2021-4122?

Apply the vendor's patch.

Is CVE-2021-4122 being exploited?

There is no known exploitation of CVE-2021-4122 in the wild and no public exploit code.

CVE-2016-4484 Auth bypass in n/a Medium 6.8

Sources

Also known as ALPINE-CVE-2021-4122, ALSA-2022:0370, CLSA-2022-1643914390, CLSA-2022-1643917881, DEBIAN-CVE-2021-4122, DSA-5070-1 and 10 more.