CVE-2019-13178

Vulnerability

CVE-2019-13178 is a race condition in the generation of the LUKS encryption keyfile within Calamares versions 3.1 through 3.2.10 [1]. The keyfile is created with default umask permissions, then changed to 0600 via chmod. Between creation and permission change, the file may be world-readable [1]. The keyfile path is typically /crypto_keyfile.bin [3]. The issue occurs during system installation when encrypted partitions are set up.

Exploitation

An attacker with local unprivileged access to the filesystem during the race window can read the keyfile. The window is short but exploitable. No authentication is required beyond a local shell, and no user interaction is needed beyond the installation process [1].

Impact

Successful exploitation yields the LUKS decryption key, which can decrypt the entire encrypted disk. An unprivileged attacker can gain full access to all data on the encrypted system, compromising confidentiality and integrity [1][3].

Mitigation

The issue is fixed in Calamares versions after 3.2.10. Users should upgrade to the latest release. No workarounds are documented. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date [1].