CVE-2021-4122 Milan Broz, its maintainer, discovered an issue in cryptsetup, the disk encryption configuration tool for Linux. LUKS2 online reencryption is an optional extension to allow a user to change the data reencryption key while the data device is available for use during the whole reencryption process. An attacker can modify on-disk metadata to simulate decryption in progress with crashed reencryption step and persistently decrypt part of the LUKS2 device . This attack requires repeated physical access to the LUKS2 device but no knowledge of user passphrases. The decryption step is performed after a valid user activates the device with a correct passphrase and modified metadata. The size of possible decrypted data per attack step depends on configured LUKS2 header size . With the default LUKS2 parameters and only one allocated keyslot , simulated decryption with checksum resilience SHA1 , the maximal decrypted size can be over 3GiB. The attack is not applicable to LUKS1 format, but the attacker can update metadata in place to LUKS2 format as an additional step. For such a converted LUKS2 header, the keyslot area is limited to decrypted size over 300 MiB. LUKS devices that were formatted using a cryptsetup binary from Debian Stretch or earlier are using LUKS1. However since Debian Buster the default on-disk LUKS format version is LUKS2. In particular, encrypted devices formatted by the Debian Buster and Bullseye installers are using LUKS2 by default. Key truncation in dm-integrity This update additionaly fixes a key truncation issue for standalone dm-integrity devices using HMAC integrity protection. For existing such devices with extra long HMAC keys , one might need to manually truncate the key using integritysetup"s `--integrity-key-size` option in order to properly map the device under 2:2.3.7-1+deb11u1 and later. Only standalone dm-integrity devices are affected. dm-crypt devices, including those using authenticated disk encryption, are unaffected.