GHSA-f5p4-p5qj-3c3h: Contrast LUKS2 Encryption Bypass via Null Cipher and Unauthenticated Metadata

Vulnerability Summary: Insecure LUKS2 persistent storage partitions may be opened and used Vulnerability Overview Vulnerability ID: GHSA-f5p4-p5qj-3c3h Severity: Moderate (CVSS 5.7 / 10) Vulnerability Type: Encryption mechanism flaw (LUKS2 metadata not authenticated + support for null encryption algorithm) Description: A malicious host can provide a forged LUKS2 volume to a Contrast Pod VM using the feature. Due to the lack of LUKS2 metadata authentication and support for the null encryption algorithm, an attacker can create a volume that can be opened without a password, thereby allowing them to read or write confidential data. Impact Scope Affected Software: Contrast Affected Versions: Impact: - Attackers can read confidential data from persistent volumes that should have been encrypted - Persistent volumes lack integrity protection, allowing attackers to tamper with data - Attackers can bypass encryption protection by forging cryptsetup devices Remediation Fixed Versions: Remediation Measures: 1. v1.12.1: Partially fixed in cryptsetup version 2.8.1 by disabling the use of non-empty passwords in key files 2. v1.13.0: - Improved LUKS2 header parsing and interpretation implemented in - Integrity protection added for secure persistent storage in Technical Details Contrast uses cryptsetup to set up secure persistent volumes, using a secret seed as the encryption key When Kubernetes identifies the device as a cryptsetup device, the initializer calls the CLI If the device was previously encrypted with the secret seed, the initializer attempts to open the device Key Issue: Versions of cryptsetup prior to 2.8.1 do not report errors when handling LUKS2 format disks using the algorithm, potentially leaving the device completely unencrypted POC / Exploit Code No specific POC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

GHSA-f5p4-p5qj-3c3h: Contrast LUKS2 Encryption Bypass via Null Cipher and Unauthenticated Metadata

More from this source