According to [0] attacks from a cold device require two steps of physical access. That would bypass signed contents of a boot partition, since you're messing wi

According to [0] attacks from a cold device require two steps of physical access. That would bypass signed contents of a boot partition, since you're messing with unprotected LUKS header contents. If the contents of the boot partition are unsigned there are probably easier attacks available. You could, for instance, deploy a kernel with crafted reencryption logic baked in over the default boot kernel. That wouldn't require this vulnerability, because the victim will be typing the passphrase into the attacker's (unprotected) kernel from /boot. [0]: https://bugzilla.redhat.com/show_bug.cgi?id=2032401 https://bugzilla.redhat.com/show_bug.cgi?id=2032401