CME-407

Data-at-Rest Encryption (LUKS/dm-crypt / BitLocker)

Harden Data Unquantified evidence Preventive

Description

Encrypts data volumes and partitions at the block device layer using LUKS2/dm-crypt, ensuring that sensitive data including credentials, tokens, PII, and configuration secrets is encrypted when stored on disk. Prevents unauthorized data access through physical media theft, backup exposure, or filesystem-level read vulnerabilities. Combined with TPM-backed key sealing, provides boot-time integrity verification and automatic unlocking for authorized systems.

CVSS Vector Impacts

Metric	Transition	Rationale
Confidentiality (C)	H → L	Even if an attacker gains file read access through a path traversal or application vulnerability, the underlying block device encryption prevents reading the actual cleartext data without the encryption key.

CWE Relationships

CWE-312 CWE-311 CWE-316

Verification

Check for LUKS-encrypted volumes

$ lsblk -o NAME,TYPE,FSTYPE | grep crypt
# Expected: At least one crypt volume present

Platform: linux

$ (Get-BitLockerVolume -MountPoint 'C:').ProtectionStatus
# Expected: On

Platform: windows

$ (Get-BitLockerVolume -MountPoint 'C:').EncryptionMethod
# Expected: XtsAes256

Platform: windows

Remediation

linux LUKS2 full-disk encryption via cryptsetup


dnf install -y cryptsetup
cryptsetup luksFormat --type luks2 --cipher aes-xts-plain64 --key-size 512 --hash sha256 <device>
cryptsetup luksOpen <device> <name>
mkfs.xfs /dev/mapper/<name>
echo '<name> <device> none discard' >> /etc/crypttab

windows BitLocker volume encryption with XTS-AES-256


Enable-BitLocker -MountPoint 'C:' -EncryptionMethod XtsAes256 -UsedSpaceOnly -RecoveryPasswordProtector

Applicability (CVE 5.2.0 Schema)

Vendor	Product	CPEs	Platforms	Status
microsoft	windows	`cpe:2.3:o:microsoft:windows_10::::::::` `cpe:2.3:o:microsoft:windows_11::::::::` `cpe:2.3:o:microsoft:windows_server_2019:::::::` `cpe:2.3:o:microsoft:windows_server_2022:::::::`	All	applicable