The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5070 advisory.

    CVE-2021-4122 Milan Broz, its maintainer, discovered an issue in cryptsetup, the disk encryption     configuration tool for Linux. LUKS2 (an on-disk format) online reencryption is an optional extension to     allow a user to change the data reencryption key while the data device is available for use during the     whole reencryption process. An attacker can modify on-disk metadata to simulate decryption in progress     with crashed (unfinished) reencryption step and persistently decrypt part of the LUKS2 device (LUKS1     devices are indirectly affected as well, see below). This attack requires repeated physical access to the     LUKS2 device but no knowledge of user passphrases. The decryption step is performed after a valid user     activates the device with a correct passphrase and modified metadata. The size of possible decrypted data     per attack step depends on configured LUKS2 header size (metadata size is configurable for LUKS2). With     the default LUKS2 parameters (16 MiB header) and only one allocated keyslot (512 bit key for AES-XTS),     simulated decryption with checksum resilience SHA1 (20 bytes checksum for 4096-byte blocks), the maximal     decrypted size can be over 3GiB. The attack is not applicable to LUKS1 format, but the attacker can update     metadata in place to LUKS2 format as an additional step. For such a converted LUKS2 header, the keyslot     area is limited to decrypted size (with SHA1 checksums) over 300 MiB. LUKS devices that were formatted     using a cryptsetup binary from Debian Stretch or earlier are using LUKS1. However since Debian Buster the     default on-disk LUKS format version is LUKS2. In particular, encrypted devices formatted by the Debian     Buster and Bullseye installers are using LUKS2 by default. Key truncation in dm-integrity This update     additionaly fixes a key truncation issue for standalone dm-integrity devices using HMAC integrity     protection. For existing such devices with extra long HMAC keys (typically >106 bytes of length), one     might need to manually truncate the key using integritysetup(8)'s --integrity-key-size option in order to     properly map the device under 2:2.3.7-1+deb11u1 and later. Only standalone dm-integrity devices are     affected. dm-crypt devices, including those using authenticated disk encryption, are unaffected. For the     oldstable distribution (buster), this problem is not present. For the stable distribution (bullseye), this     problem has been fixed in version 2:2.3.7-1+deb11u1. We recommend that you upgrade your cryptsetup     packages. For the detailed security status of cryptsetup please refer to its security tracker page at:
    https://security-tracker.debian.org/tracker/cryptsetup

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-064 advisory.

    It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during     the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could     use this flaw to force a user into permanently disabling the encryption layer of that medium.
    (CVE-2021-4122)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the cryptsetup packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during     the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could     use this flaw to force a user into permanently disabling the encryption layer of that medium.
    (CVE-2021-4122)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the cryptsetup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during     the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could     use this flaw to force a user into permanently disabling the encryption layer of that medium.
    (CVE-2021-4122)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2022:0008 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-4122:
    It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during     the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could     use this flaw to force a user into permanently disabling the encryption layer of that medium.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0144-1 advisory.

  - It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during     the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could     use this flaw to force a user into permanently disabling the encryption layer of that medium.
    (CVE-2021-4122)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	Name	Product	Family	Published	Updated	Severity
157886	Debian DSA-5070-1 : cryptsetup - security update	Nessus	Debian Local Security Checks	2/11/2022	1/24/2025	medium
164725	Amazon Linux 2022 : cryptsetup, cryptsetup-devel, cryptsetup-libs (ALAS2022-2022-064)	Nessus	Amazon Linux Local Security Checks	9/6/2022	12/11/2024	medium
165378	EulerOS Virtualization 2.9.1 : cryptsetup (EulerOS-SA-2022-2339)	Nessus	Huawei Local Security Checks	9/23/2022	12/2/2022	medium
165796	EulerOS 2.0 SP10 : cryptsetup (EulerOS-SA-2022-2424)	Nessus	Huawei Local Security Checks	10/8/2022	11/29/2022	medium
169337	EulerOS Virtualization 2.10.1 : cryptsetup (EulerOS-SA-2022-2888)	Nessus	Huawei Local Security Checks	12/27/2022	12/27/2022	medium
236499	Alibaba Cloud Linux 3 : 0008: cryptsetup (ALINUX3-SA-2022:0008)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	medium
156928	SUSE SLED15 / SLES15 Security Update : cryptsetup (SUSE-SU-2022:0144-1)	Nessus	SuSE Local Security Checks	1/21/2022	7/14/2023	medium
504328	Siemens SIMATIC S7-1500 Insufficient Verification of Data Authenticity (CVE-2021-4122)	Tenable OT Security	Tenable.ot	11/13/2025	11/13/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium