cryptsetup 2.2.0 LUKS2 Validator luks2_json_metadata.c hdr_validate_segments out-of-bounds write

Summaryinfo

A vulnerability was found in cryptsetup 2.2.0. It has been declared as critical. The impacted element is the function hdr_validate_segments in the library lib/luks2/luks2_json_metadata.c of the component LUKS2 Validator. Such manipulation leads to out-of-bounds write. This vulnerability is referenced as CVE-2020-14382. The attack can only be performed from a local environment. No exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in cryptsetup 2.2.0. Affected by this issue is the function hdr_validate_segments in the library lib/luks2/luks2_json_metadata.c of the component LUKS2 Validator. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement "intervals = malloc(first_backup * sizeof(*intervals));"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.

The weakness was published 09/16/2020 as Bug 1874712 as not defined bug report (Bugzilla). The advisory is shared for download at bugzilla.redhat.com. This vulnerability is handled as CVE-2020-14382 since 06/17/2020. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• cryptsetup

Version

• 2.2.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion