CVE-2025-58356

HighCVSS 8.3

Published: 27/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

Constellation, the first Confidential Kubernetes, uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted storage device, the CVM uses the libcryptsetup function crypt_activate_by_passphrase. Due to unsafe handling of null keyslot algorithms in cryptsetup 2.8.1, it is possible that the opened volume is not encrypted at all. Cryptsetup prior to 2.8.1 does not report an error when processing LUKS2-formatted disks using the cipher_null-ecb algorithm in the keyslot encryption field. This vulnerability is fixed in 2.24.0.

Risk Assessment

An attacker could exploit this vulnerability to access data that should be confidential, as the volume may be opened without actual encryption, compromising data confidentiality.

Recommendation

Update cryptsetup to version 2.24.0 or later and verify that all volumes are actually encrypted.

Other vulnerabilities in cryptsetup

CVE-2021-4122Medium
It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

Original NVD description (English source)

Constellation is the first Confidential Kubernetes. The Constellation CVM image uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted storage device, the CVM uses the libcryptsetup function crypt_activate_by_passhrase. If the VM is successful in opening the partition with the disk encryption key, it treats the volume as confidential. However, due to the unsafe handling of null keyslot algorithms in the cryptsetup 2.8.1, it is possible that the opened volume is not encrypted at all. Cryptsetup prior to version 2.8.1 does not report an error when processing LUKS2-formatted disks that use the cipher_null-ecb algorithm in the keyslot encryption field. This vulnerability is fixed in 2.24.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS