Homepage

Out-of-bounds Write The advisory has been revoked - it doesn't affect any version of package cryptsetup  (opens in a new tab)

Threat Intelligence

EPSS
1.16% (63rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN9-CRYPTSETUP-609560
  • published3 Sept 2020
  • disclosed16 Sept 2020
Report a new vulnerability Found a mistake?

Introduced: 3 Sep 2020

CVE-2020-14382  (opens in a new tab)
CWE-787  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream cryptsetup package and not the cryptsetup package as distributed by Debian.

A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement "intervals = malloc(first_backup * sizeof(*intervals));"). Due to the bug, library can be tricked to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.