CVE-2020-14382
published 2020-09-16CVE-2020-14382: A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every…
PriorityP338high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
1.16%
63.8th percentile
A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement "intervals = malloc(first_backup * sizeof(*intervals));"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| cryptsetup_project | cryptsetup | — | — |
| cryptsetup_project | cryptsetup | — | — |
| cryptsetup_project | cryptsetup | >= 0 < 2:2.3.4-1 | 2:2.3.4-1 |
| cryptsetup_project | cryptsetup | >= 0 < 2:2.3.4-1 | 2:2.3.4-1 |
| cryptsetup_project | cryptsetup | >= 0 < 2:2.3.4-1 | 2:2.3.4-1 |
| cryptsetup_project | cryptsetup | >= 0 < 2:2.3.4-1 | 2:2.3.4-1 |
| debian | cryptsetup | < cryptsetup 2:2.3.4-1 (bookworm) | cryptsetup 2:2.3.4-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v8mw-xqhr-2vqp: A vulnerability was found in upstream release cryptsetup-2
ghsa_unreviewed·2022-05-24
CVE-2020-14382 [HIGH] CWE-787 GHSA-v8mw-xqhr-2vqp: A vulnerability was found in upstream release cryptsetup-2
A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement "intervals = malloc(first_backup * sizeof(*intervals));"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.
OSV
CVE-2020-14382: A vulnerability was found in upstream release cryptsetup-2
osv·2020-09-16·CVSS 7.8
CVE-2020-14382 [HIGH] CVE-2020-14382: A vulnerability was found in upstream release cryptsetup-2
A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement "intervals = malloc(first_backup * sizeof(*intervals));"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.
Ubuntu
cryptsetup vulnerability
vendor_ubuntu·2020-09-14
CVE-2020-14382 cryptsetup vulnerability
Title: cryptsetup vulnerability
Summary: cryptsetup could be made to execute arbitrary code if it received a specially
crafted input.
It was discovered that cryptsetup incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
cryptsetup: Out-of-bounds write when validating segments
vendor_redhat·2020-09-03·CVSS 7.8
CVE-2020-14382 [HIGH] CWE-787 cryptsetup: Out-of-bounds write when validating segments
cryptsetup: Out-of-bounds write when validating segments
A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement "intervals = malloc(first_backup * sizeof(*intervals));"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually
Debian
CVE-2020-14382: cryptsetup - A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a ...
vendor_debian·2020·CVSS 7.8
CVE-2020-14382 [HIGH] CVE-2020-14382: cryptsetup - A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a ...
A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement "intervals = malloc(first_backup * sizeof(*intervals));"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.
Scope: local
book
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-14382 cryptsetup: Out-of-bounds write when validating segments [fedora-all]
bugzilla·2020-09-03·CVSS 7.8
CVE-2020-14382 [HIGH] CVE-2020-14382 cryptsetup: Out-of-bounds write when validating segments [fedora-all]
CVE-2020-14382 cryptsetup: Out-of-bounds write when validating segments [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported v
Bugzilla
CVE-2020-14382 cryptsetup: Out-of-bounds write when validating segments
bugzilla·2020-09-02·CVSS 7.8
CVE-2020-14382 [HIGH] CVE-2020-14382 cryptsetup: Out-of-bounds write when validating segments
CVE-2020-14382 cryptsetup: Out-of-bounds write when validating segments
As per the reporter:
There's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement "intervals = malloc(first_backup * sizeof(*intervals));"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated
https://bugzilla.redhat.com/show_bug.cgi?id=1874712https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OJTQ4KSVCW2NMSU5WFVPOHY46WMNF4OB/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD6YSD63LLRRC4WQ7DJLSXWNUCY6FWBM/https://usn.ubuntu.com/4493-1/https://bugzilla.redhat.com/show_bug.cgi?id=1874712https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OJTQ4KSVCW2NMSU5WFVPOHY46WMNF4OB/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD6YSD63LLRRC4WQ7DJLSXWNUCY6FWBM/https://usn.ubuntu.com/4493-1/
2020-09-16
Published