Vulnerability Name:

CVE-2020-14382

Assigned:2020-09-03
Published:2020-09-03
Updated:2022-01-01
Summary:A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement "intervals = malloc(first_backup * sizeof(*intervals));"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.
CVSS v3 Severity:7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.8 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-787
References:Source: MITRE
Type: CNA
CVE-2020-14382

Source: MISC
Type: Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1874712

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-5ed5af6275

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-8c76e12e62

Source: UBUNTU
Type: Third Party Advisory
USN-4493-1

Vulnerable Configuration:Configuration 1:
  • cpe:/a:cryptsetup_project:cryptsetup:2.2.0:-:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

    • Configuration 4:
  • cpe:/o:fedoraproject:fedora:31:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:33:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:8::baseos:*:*:*:*:*

    • * Denotes that component is vulnerable
    Vulnerability Name:

    CVE-2020-14382 (CCN-188540)

    Assigned:2020-09-03
    Published:2020-09-03
    Updated:2020-09-25
    Summary:A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement "intervals = malloc(first_backup * sizeof(*intervals));"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.
    CVSS v3 Severity:7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
    6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
    Exploitability Metrics:Attack Vector (AV): Local
    Attack Complexity (AC): Low
    Privileges Required (PR): None
    User Interaction (UI): Required
    Scope:Scope (S): Unchanged
    Impact Metrics:Confidentiality (C): High
    Integrity (I): High
    Availibility (A): High
    5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
    4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)
    Exploitability Metrics:Attack Vector (AV): Local
    Attack Complexity (AC): Low
    Privileges Required (PR): None
    User Interaction (UI): Required
    Scope:Scope (S): Unchanged
    Impact Metrics:Confidentiality (C): Low
    Integrity (I): Low
    Availibility (A): Low
    7.8 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
    6.8 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
    Exploitability Metrics:Attack Vector (AV): Local
    Attack Complexity (AC): Low
    Privileges Required (PR): None
    User Interaction (UI): Required
    Scope:Scope (S): Unchanged
    Impact Metrics:Confidentiality (C): High
    Integrity (I): High
    Availibility (A): High
    CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
    Exploitability Metrics:Access Vector (AV): Network
    Access Complexity (AC): Medium
    Authentication (Au): None
    Impact Metrics:Confidentiality (C): Partial
    Integrity (I): Partial
    Availibility (A): Partial
    4.3 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:P/I:P/A:P)
    Exploitability Metrics:Access Vector (AV): Local
    Access Complexity (AC): Low
    Athentication (Au): Single_Instance
    Impact Metrics:Confidentiality (C): Partial
    Integrity (I): Partial
    Availibility (A): Partial
    Vulnerability Type:CWE-787
    Vulnerability Consequences:Gain Access
    References:Source: MITRE
    Type: CNA
    CVE-2020-14382

    Source: CCN
    Type: Red Hat Bugzilla - Bug 1874712
    (CVE-2020-14382) - CVE-2020-14382 cryptsetup: Out-of-bounds write when validating segments

    Source: MISC
    Type: Issue Tracking, Patch, Third Party Advisory
    https://bugzilla.redhat.com/show_bug.cgi?id=1874712

    Source: XF
    Type: UNKNOWN
    cryptsetup-cve202014382-code-exec(188540)

    Source: CCN
    Type: Cryptsetup GIT Repository
    Cryptsetup

    Source: FEDORA
    Type: Third Party Advisory
    FEDORA-2020-5ed5af6275

    Source: FEDORA
    Type: UNKNOWN
    FEDORA-2020-8c76e12e62

    Source: UBUNTU
    Type: Third Party Advisory
    USN-4493-1

    Vulnerable Configuration:Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*
    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*
    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:8:*:*:*:*:*:*:*
    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:8::baseos:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:cryptsetup_project:cryptsetup:2.2.0:-:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:7473
    P
    		cryptsetup-2.4.3-150400.1.110 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:2899
    P
    		cryptsetup-2.4.3-150400.1.110 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94529
    P
    		cryptsetup-2.4.3-150400.1.110 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:35
    P
    		cryptsetup-2.3.4-1.34 on GA media (Moderate)
    2022-06-13
    oval:org.opensuse.security:def:964
    P
    		Security update for the Linux Kernel (Important)
    2022-03-08
    oval:org.opensuse.security:def:112120
    P
    		cryptsetup-2.4.1-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:105657
    P
    		cryptsetup-2.4.1-1.1 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:71794
    P
    		cryptsetup-2.3.4-1.34 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62053
    P
    		cryptsetup-2.3.4-1.34 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:100811
    P
    		cryptsetup-2.3.4-1.34 on GA media (Moderate)
    2021-08-09
    oval:com.redhat.rhsa:def:20204542
    P
    		RHSA-2020:4542: cryptsetup security, bug fix, and enhancement update (Moderate)
    2020-11-04
    BACK
    cryptsetup_project cryptsetup 2.2.0 -
    redhat enterprise linux 8.0
    canonical ubuntu linux 20.04
    fedoraproject fedora 31
    fedoraproject fedora 33
    cryptsetup_project cryptsetup 2.2.0 -