A vulnerability (CVE-2021-4122) has been discovered in the Cryptsetup package, used for encrypting disk partitions in Linux, that allows modification of metadata to disable encryption in partitions formatted with LUKS2 (Linux Unified Key Setup). To exploit this vulnerability, an attacker must have physical access to the encrypted medium, meaning this method is primarily relevant for attacks on encrypted external drives, such as USB flash drives, to which the attacker has access but does not know the password to decrypt the data.
The attack is applicable only to the LUKS2 format and involves manipulating the metadata responsible for enabling the 'online reencryption' feature, which allows the data re-encryption process to be initiated on the fly without interrupting access to the partition when a key change is necessary. Since the decryption and encryption process with a new key takes a long time, 'online reencryption' enables continuous access to the partition while re-encrypting data in the background, gradually switching the data from one key to another. Additionally, it is possible to select an empty target key, which allows the partition to be converted to an unencrypted state.
An attacker can make changes to the LUKS2 metadata that simulate an abrupt interruption of the decryption operation due to a failure, allowing them to decrypt part of the partition after the modified medium has been activated and used by the owner. In this case, the user who connects the modified medium and unlocks it with the correct password receives no warning regarding the resumption of the interrupted re-encryption process and may only learn about the status of this operation using the 'luks Dump' command. The amount of data the attacker can decrypt depends on the size of the LUKS2 header, but with the default size (16 MiB), it can exceed 3 GB.
The issue arises from the fact that, although re-encryption requires the calculation and checking of the hashes of the new and old keys, the hash is not required to initiate decryption if the new state implies the absence of a key for encryption (plaintext). Moreover, the metadata of LUKS2, which specifies the encryption algorithm, is not protected from modification if it falls into the hands of an attacker. To mitigate this vulnerability, developers have added additional protection for metadata in LUKS2, which now verifies an additional hash computed based on known keys and the contents of the metadata; thus, an attacker can no longer silently modify the metadata without knowing the password for decryption.
A typical attack scenario requires the attacker to have the opportunity to get hold of the drive multiple times. Initially, the attacker, who does not know the access password, makes changes to the metadata area that trigger the decryption of part of the data upon the next activation of the drive. The drive is then returned to its original location, and the attacker waits for the user to connect it by entering the password. During the activation of the device by the user, a background re-encryption process is initiated, during which part of the encrypted data is replaced with decrypted data. Then, if the attacker can gain access to the device again, some of the data on the drive will be in decrypted form.
The problem was identified by the maintainer of the cryptsetup project and has been resolved in updates to cryptsetup 2.4.3 and 2.3.7. The status of updates addressing the issue in distributions can be tracked on the following pages: Debian, RHEL, SUSE, Fedora, Ubuntu, Arch. The vulnerability only manifests from the release of cryptsetup 2.2.0, which introduced support for the 'online reencryption' operation. As a workaround for protection, the run option '--disable-luks2-reencryption' can be utilized.
Source: opennet.ru
