CVE catalog

CVE-2020-14382

cryptsetup: CVE-2020-14382

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.16% · Oct 25, 2026

A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement "intervals = malloc(first_backup * sizeof(*intervals));"). Due to the bug, library can be *tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancryptsetupsid2:2.8.8-1fixed
Debiancryptsetupforky2:2.8.8-1fixed
Debiancryptsetuptrixie2:2.7.5-2fixed
Debiancryptsetupbookworm2:2.6.1-4~deb12u2fixed
Alpinecryptsetup3.112.2.2-r1fixed
Alpinecryptsetup3.122.3.2-r1fixed
Alpinecryptsetup3.132.3.4-r0fixed
Alpinecryptsetup3.142.3.4-r0fixed
Alpinecryptsetup3.152.3.4-r0fixed
Alpinecryptsetup3.162.3.4-r0fixed
Alpinecryptsetup3.172.3.4-r0fixed
Alpinecryptsetup3.182.3.4-r0fixed
Alpinecryptsetup3.192.3.4-r0fixed
Alpinecryptsetup3.202.3.4-r0fixed
Alpinecryptsetup3.212.3.4-r0fixed
Alpinecryptsetup3.222.3.4-r0fixed
Alpinecryptsetup3.232.3.4-r0fixed
Alpinecryptsetup3.242.3.4-r0fixed
Ubuntucryptsetup20.042:2.2.0-3ubuntu1vulnerable
Ubuntucryptsetup20.042:2.2.1-1ubuntu1vulnerable
Ubuntucryptsetup20.042:2.2.2-1ubuntu1vulnerable
Ubuntucryptsetup20.042:2.2.2-2ubuntu1vulnerable
Ubuntucryptsetup20.042:2.2.2-3ubuntu1vulnerable
Ubuntucryptsetup20.042:2.2.2-3ubuntu2vulnerable
Ubuntucryptsetup20.042:2.2.2-3ubuntu2.2fixed
Ubuntucryptsetup20.042:2.2.0-3ubuntu1vulnerable
Ubuntucryptsetup20.042:2.2.1-1ubuntu1vulnerable
Ubuntucryptsetup20.042:2.2.2-1ubuntu1vulnerable
Ubuntucryptsetup20.042:2.2.2-2ubuntu1vulnerable
Ubuntucryptsetup20.042:2.2.2-3ubuntu1vulnerable
Ubuntucryptsetup20.042:2.2.2-3ubuntu2vulnerable
Ubuntucryptsetup20.042:2.2.2-3ubuntu2.2fixed
Opensusecryptsetuptumbleweed2.4.1-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancryptsetupsourcesid2:2.3.4-1not yet assignedNot reported[969471]
Debiancryptsetupsourceforky2:2.3.4-1not yet assignedNot reported[969471]
Debiancryptsetupsourcetrixie2:2.3.4-1not yet assignedNot reported[969471]
Debiancryptsetupsourcebookworm2:2.3.4-1not yet assignedNot reported[969471]
Alpinecryptsetupapk3.112.2.2-r1Not reportedALPINE-CVE-2020-14382Not reported
Alpinecryptsetupapk3.122.3.2-r1Not reportedALPINE-CVE-2020-14382Not reported
Alpinecryptsetupapk3.132.3.4-r0Not reportedALPINE-CVE-2020-14382Not reported
Alpinecryptsetupapk3.142.3.4-r0Not reportedALPINE-CVE-2020-14382Not reported
Alpinecryptsetupapk3.152.3.4-r0Not reportedALPINE-CVE-2020-14382Not reported
Alpinecryptsetupapk3.162.3.4-r0Not reportedALPINE-CVE-2020-14382Not reported
Alpinecryptsetupapk3.172.3.4-r0Not reportedALPINE-CVE-2020-14382Not reported
Alpinecryptsetupapk3.182.3.4-r0Not reportedALPINE-CVE-2020-14382Not reported
Alpinecryptsetupapk3.192.3.4-r0Not reportedALPINE-CVE-2020-14382Not reported
Alpinecryptsetupapk3.202.3.4-r0Not reportedALPINE-CVE-2020-14382Not reported
Alpinecryptsetupapk3.212.3.4-r0Not reportedALPINE-CVE-2020-14382Not reported
Alpinecryptsetupapk3.222.3.4-r0Not reportedALPINE-CVE-2020-14382Not reported
Alpinecryptsetupapk3.232.3.4-r0Not reportedALPINE-CVE-2020-14382Not reported
Alpinecryptsetupapk3.242.3.4-r0Not reportedALPINE-CVE-2020-14382Not reported
Ubuntucryptsetupdeb20.042:2.2.2-3ubuntu2.2Not reportedUBUNTU-CVE-2020-14382Not reported
Ubuntucryptsetupdeb20.042:2.2.2-3ubuntu2.2Not reportedUSN-4493-1Not reported
Opensusecryptsetuprpmtumbleweed2.4.1-1.1Not reportedOPENSUSE-SU-2024:10704-1Not reported

[Debian bug #969471]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [cryptsetup-doc]Unknown

    Source package: [cryptsetup]

    Details (1)

    • 2.8.7-1.2 · noarch · tumbleweed

      Unknown · Fixed: 2.4.1-1.1

      Version impact unknown

      dsa · cryptsetup · opensuse · tumbleweed

  • [cryptsetup-lang]Unknown

    Source package: [cryptsetup]

    Details (1)

    • 2.8.7-1.2 · noarch · tumbleweed

      Unknown · Fixed: 2.4.1-1.1

      Version impact unknown

      dsa · cryptsetup · opensuse · tumbleweed

  • [cryptsetup-ssh]Unknown

    Source package: [cryptsetup]

    Details (1)

    • 2.8.7-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.4.1-1.1

      Version impact unknown

      dsa · cryptsetup · opensuse · tumbleweed

  • [libcryptsetup12]Unknown

    Source package: [cryptsetup]

    Details (1)

    • 2.8.7-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.4.1-1.1

      Version impact unknown

      dsa · cryptsetup · opensuse · tumbleweed

  • [libcryptsetup12-32bit]Unknown

    Source package: [cryptsetup]

    Details (1)

    • 2.8.7-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.4.1-1.1

      Version impact unknown

      dsa · cryptsetup · opensuse · tumbleweed

  • [libcryptsetup-devel]Unknown

    Source package: [cryptsetup]

    Details (1)

    • 2.8.7-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.4.1-1.1

      Version impact unknown

      dsa · cryptsetup · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [cryptsetup]Fixed
    Details (2)

    • 2:2.6.1-4~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · bookworm; dsa · cryptsetup · debian · 12

    • 2:2.6.1-4~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · bookworm; dsa · cryptsetup · debian · 12

  • [cryptsetup-bin]Fixed

    Source package: [cryptsetup]

    Details (2)

    • 2:2.6.1-4~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · bookworm; dsa · cryptsetup · debian · 12

    • 2:2.6.1-4~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · bookworm; dsa · cryptsetup · debian · 12

  • [cryptsetup-initramfs]Fixed

    Source package: [cryptsetup]

    Details (2)

    • 2:2.6.1-4~deb12u2 · all · bookworm

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · bookworm; dsa · cryptsetup · debian · 12

    • 2:2.6.1-4~deb12u2 · all · bookworm

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · bookworm; dsa · cryptsetup · debian · 12

  • [cryptsetup-run]Fixed

    Source package: [cryptsetup]

    Details (2)

    • 2:2.6.1-4~deb12u2 · all · bookworm

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · bookworm; dsa · cryptsetup · debian · 12

    • 2:2.6.1-4~deb12u2 · all · bookworm

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · bookworm; dsa · cryptsetup · debian · 12

  • [cryptsetup-ssh]Fixed

    Source package: [cryptsetup]

    Details (2)

    • 2:2.6.1-4~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · bookworm; dsa · cryptsetup · debian · 12

    • 2:2.6.1-4~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · bookworm; dsa · cryptsetup · debian · 12

  • [cryptsetup-suspend]Fixed

    Source package: [cryptsetup]

    Details (2)

    • 2:2.6.1-4~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · bookworm; dsa · cryptsetup · debian · 12

    • 2:2.6.1-4~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · bookworm; dsa · cryptsetup · debian · 12

  • [libcryptsetup12]Fixed

    Source package: [cryptsetup]

    Details (2)

    • 2:2.6.1-4~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · bookworm; dsa · cryptsetup · debian · 12

    • 2:2.6.1-4~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · bookworm; dsa · cryptsetup · debian · 12

  • [libcryptsetup-dev]Fixed

    Source package: [cryptsetup]

    Details (2)

    • 2:2.6.1-4~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · bookworm; dsa · cryptsetup · debian · 12

    • 2:2.6.1-4~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · bookworm; dsa · cryptsetup · debian · 12

[Debian 13 (Trixie)]

  • [cryptsetup]Fixed
    Details (2)

    • 2:2.7.5-2 · amd64 · trixie

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · 13

    • 2:2.7.5-2 · arm64 · trixie

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · 13

  • [cryptsetup-bin]Fixed

    Source package: [cryptsetup]

    Details (2)

    • 2:2.7.5-2 · amd64 · trixie

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · 13

    • 2:2.7.5-2 · arm64 · trixie

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · 13

  • [cryptsetup-initramfs]Fixed

    Source package: [cryptsetup]

    Details (2)

    • 2:2.7.5-2 · all · trixie

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · 13

    • 2:2.7.5-2 · all · trixie

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · 13

  • [cryptsetup-ssh]Fixed

    Source package: [cryptsetup]

    Details (2)

    • 2:2.7.5-2 · amd64 · trixie

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · 13

    • 2:2.7.5-2 · arm64 · trixie

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · 13

  • [cryptsetup-suspend]Fixed

    Source package: [cryptsetup]

    Details (2)

    • 2:2.7.5-2 · amd64 · trixie

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · 13

    • 2:2.7.5-2 · arm64 · trixie

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · 13

  • [libcryptsetup12]Fixed

    Source package: [cryptsetup]

    Details (2)

    • 2:2.7.5-2 · amd64 · trixie

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · 13

    • 2:2.7.5-2 · arm64 · trixie

      Fixed · Fixed: 2:2.3.4-1

      dsa · cryptsetup · debian · 13

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]