Out-of-bounds write in cryptsetup - CVE-2020-14382

Vulnerability identifier: #VU46824

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-14382

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement "intervals = malloc(first_backup * sizeof(*intervals));"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.

cryptsetup
perl-dbi (Alpine package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
cryptsetup (Red Hat package)
cryptsetup (Ubuntu package)
cryptsetup
Quay
OpenShift Data Foundation (formerly OpenShift Container Storage)
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Ubuntu
Fedora

Install update from vendor's website.

Quay - update to 3.3.3
cryptsetup (Red Hat package) - addressed in versions 2.2.2-1.el8_2.1, 2.3.3-2.el8
cryptsetup (Ubuntu package) - update to 2:2.2.2-3ubuntu2.2
cryptsetup - addressed in versions 2.3.4-1.fc31, 2.3.4-1.fc32, 2.3.4-1.fc33

• https://bugzilla.redhat.com/show_bug.cgi?id=1874712
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OJTQ4KSVCW2NMSU5WFVPOHY46WMNF4OB/
• https://usn.ubuntu.com/4493-1/

• Out-of-bounds write in cryptsetup (Alpine package)
• Red Hat Enterprise Linux 8 update for cryptsetup
• Red Hat Enterprise Linux 8 update for cryptsetup
• Multiple vulnerabilities in Red Hat OpenShift Container Storage
• Multiple vulnerabilities in Red Hat Quay
• Red Hat Enterprise Linux 8.2 update for cryptsetup
• Ubuntu update for cryptsetup
• Fedora 32 update for cryptsetup
• Fedora 33 update for cryptsetup
• Fedora 31 update for cryptsetup