4.4
Medium
CVE-2025-11568 Luksmeta: data corruption when handling luks1 partitions with luksmeta
Description
A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker with the necessary permissions can exploit this flaw by writing a large amount of metadata to an encrypted device. The utility fails to correctly validate the available space, causing the metadata to overwrite and corrupt the user's encrypted data. This action leads to a permanent loss of the stored information. Devices using the LUKS formats other than LUKS1 are not affected by this issue.
CVSS 3.1 detail
Vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:NExploitable with local access to the machine, with an administrator account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- High
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| luksmeta 10 | earliest → < 10 | 10 |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat In-Vehicle Operating System 1 | Versions not published |
References
- RHSA-2025:23086 access.redhat.com
- RHSA-2026:18421 access.redhat.com
- RHSA-2026:18824 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2404244 bugzilla.redhat.com
- github.com github.com
Timeline
- Published
- Last modified