description: It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.
problem types: CWE-345 - Insufficient Verification of Data Authenticity
affected:
{
product: cryptsetup
vendor: n/a
versions:
status: affected, version: Fixed in cryptsetup 2.4.3, cryptsetup 2.3.7
}