Security update for cryptsetup

The cryptsetup update fixes a problem (bsc#1270254) related to the unintended pinning of all volume keys through the caller's credentials when the kernel opens a file. This issue stems from a kernel change (commit a28d893eb327) that ported block device access to file, which inadvertently caused the caller's thread keyring to persist beyond the caller's lifetime. The fix involves adding a keyring key type, loading volume keys into an intermediary keyring linked to the thread keyring, and using unique intermediary keyring names per device. Several regression tests were added to ensure the fix's effectiveness.

The vulnerability could lead to volume keys being retained longer than intended in the kernel's thread keyring, potentially increasing the risk of key exposure or misuse within the system. However, no known exploits are reported in the wild, and the impact is limited to key management behavior within the kernel and cryptsetup interaction.

An official security update for cryptsetup has been released that addresses this issue. Users should apply the update to ensure the fix is in place. No additional mitigation steps are indicated beyond applying the provided update.