Unknown · Cryptsetup · CVE-2021-4122
**Name of the Vulnerable Software and Affected Versions**
cryptsetup versions 2.2.0 through 2.3.6
cryptsetup versions 2.4.0 through 2.4.2
**Description**
A flaw was found in cryptsetup that could allow an attacker with physical access to a medium, such as a flash disk, to trick the system into disabling encryption during device recovery. This could force a user into permanently disabling the encryption layer of the medium. The issue is related to the modification of LUKS2 metadata, which can be altered without knowing the encryption key, allowing an attacker to simulate a previously started decryption process and leave some decrypted data in plaintext.
**Recommendations**
For cryptsetup versions 2.2.0 through 2.3.6, update to version 2.3.7 or later.
For cryptsetup versions 2.4.0 through 2.4.2, update to version 2.4.3 or later.
As a temporary workaround, consider using `luksDump` to monitor for potential attacks and restrict physical access to encrypted media to minimize the risk of exploitation.