Arbitrary Data Exposure Vulnerability in Dstack Software Development Kit

CVE-2025-59054

What is CVE-2025-59054?

The Dstack software development kit (SDK) is susceptible to a significant data exposure vulnerability in versions prior to 0.5.4. Attackers can exploit crafted LUKS2 data volumes provided by a malicious host when mounting as the '/data' directory. This results in the unauthorized opening of the volume and writing of sensitive information, such as Wireguard keys, using attacker-known keys. Furthermore, LUKS2 volume metadata lacks proper authentication and may utilize weak null key-encryption methods. Consequently, attackers can manipulate volume data and metadata, enabling them to conduct unauthorized data recording and execution compromises within guest environments. The vulnerability is mitigated in version 0.5.4, highlighting the importance of upgrading to secure application deployments.

References