[SECURITY] [DSA 5070-1] cryptsetup security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5070-1 security@debian.org
https://www.debian.org/security/ Yves-Alexis Perez
February 10, 2022 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : cryptsetup
CVE ID : CVE-2021-4122
Debian Bug : 1003686 949336
CVE-2021-4122
Milan Broz, its maintainer, discovered an issue in cryptsetup, the disk
encryption configuration tool for Linux.
LUKS2 (an on-disk format) online reencryption is an optional extension to
allow a user to change the data reencryption key while the data device is
available for use during the whole reencryption process.
An attacker can modify on-disk metadata to simulate decryption in progress
with crashed (unfinished) reencryption step and persistently decrypt part
of the LUKS2 device (LUKS1 devices are indirectly affected as well, see
below).
This attack requires repeated physical access to the LUKS2 device but no
knowledge of user passphrases.
The decryption step is performed after a valid user activates the device
with a correct passphrase and modified metadata.
The size of possible decrypted data per attack step depends on configured
LUKS2 header size (metadata size is configurable for LUKS2). With the
default LUKS2 parameters (16 MiB header) and only one allocated keyslot
(512 bit key for AES-XTS), simulated decryption with checksum resilience
SHA1 (20 bytes checksum for 4096-byte blocks), the maximal decrypted size
can be over 3GiB.
The attack is not applicable to LUKS1 format, but the attacker can update
metadata in place to LUKS2 format as an additional step. For such a
converted LUKS2 header, the keyslot area is limited to decrypted size (with
SHA1 checksums) over 300 MiB.
LUKS devices that were formatted using a cryptsetup binary from Debian
Stretch or earlier are using LUKS1. However since Debian Buster the default
on-disk LUKS format version is LUKS2. In particular, encrypted devices
formatted by the Debian Buster and Bullseye installers are using LUKS2 by
default.
Key truncation in dm-integrity
This update additionaly fixes a key truncation issue for standalone
dm-integrity devices using HMAC integrity protection. For existing such
devices with extra long HMAC keys (typically >106 bytes of length), one
might need to manually truncate the key using integritysetup(8)'s
`--integrity-key-size` option in order to properly map the device under
2:2.3.7-1+deb11u1 and later.
Only standalone dm-integrity devices are affected. dm-crypt devices,
including those using authenticated disk encryption, are unaffected.
For the oldstable distribution (buster), this problem is not present.
For the stable distribution (bullseye), this problem has been fixed in
in version 2:2.3.7-1+deb11u1.
We recommend that you upgrade your cryptsetup packages.
For the detailed security status of cryptsetup please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/cryptsetup
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEE8vi34Qgfo83x35gF3rYcyPpXRFsFAmIFZ6gACgkQ3rYcyPpX
RFtuXwgAqiSmRn73X9qh6w5KPBUERn7Rg6XP6NuAyISv0YFmVb1h5ySLIrZX1mMS
n9yfKmPY3izAUrl6qQdU/0htb4TSyv/kRrpkRcBlwaCCkVns+75Ogfg5US3m1xeb
HxHN+0MXZuPRQfsD/hmDF3SdVX7P/Me6ihhDY8J0rQpYSdWqLUVlC9NxxloqUo6z
kHvdUyREjis+xtq5LaQp4GSfv+AuJhdBzOssFL0gcC7TPOqWM3TOhL0gO8kNFKjS
GrgG5GbdCkjKgGgz/B1gVy5HMWkMlc2ty+9SLxXpo4zFP+65yLeBjV5/L6s8zDxG
M8bG5AMz3t6ymbY53bnCqIY4DR9QnA==
=Eu3C
-----END PGP SIGNATURE-----
Reply to: