---
id: CVE-2021-4122
title: >-
  It was found that a specially crafted LUKS header could trick cryptsetup into
  disabling encryption during the recovery of the device
summary: >-
  It was found that a specially crafted LUKS header could trick cryptsetup into
  disabling encryption during the recovery of the device. An attacker with
  physical access to the medium, such as a flash disk, could use this flaw to
  force a us…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'
cwe:
  - CWE-345
vendor: cryptsetup_project
product: cryptsetup
affected:
  - cryptsetup < 2.3.7
  - 'cryptsetup >= 2.4.0, < 2.4.3'
patched:
  - cryptsetup 2.4.3
published: '2022-08-24'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T11:16:54.753'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-4122'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2021-4122'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2031859'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2032401'
    label: secalert@redhat.com
  - url: >-
      https://gitlab.com/cryptsetup/cryptsetup/-/commit/0113ac2d889c5322659ad0596d4cfc6da53e356c
    label: secalert@redhat.com
  - url: >-
      https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.4/v2.4.3-ReleaseNotes
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2021-4122'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2031859'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2032401'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://gitlab.com/cryptsetup/cryptsetup/-/commit/0113ac2d889c5322659ad0596d4cfc6da53e356c
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.4/v2.4.3-ReleaseNotes
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00312
epssPercentile: 0.22387
ingestedAt: '2026-10-14T11:27:22.128Z'
---

## Overview

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

## Affected

- `cryptsetup < 2.3.7`
- `cryptsetup >= 2.4.0, < 2.4.3`

## Remediation

Upgrade past the affected range:

- `cryptsetup 2.4.3`