#VU46824 Out-of-bounds write in cryptsetup

Published: 2020-09-16 | Updated: 2020-09-21

Vulnerability identifier: #VU46824

Vulnerability risk: High


CVE-ID: CVE-2020-14382


Exploitation vector: Network

Exploit availability:

Vulnerable software:
Other software / Other software solutions

Vendor: cryptsetup


The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement "intervals = malloc(first_backup * sizeof(*intervals));"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.

Install update from vendor's website.

Vulnerable software versions

cryptsetup: 2.2.0

Fixed software versions


External links

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

Latest bulletins with this vulnerability