Insecure LUKS2 Persistent Volume in Contrast Kubernetes Runtime

CVE-2025-71422

What is CVE-2025-71422?

The Contrast Kubernetes runtime prior to version 1.12.1 is exposed to a security risk where a malicious host can exploit its secure persistent volume feature by supplying a crafted LUKS2 volume. This occurs because the LUKS2 volume metadata is not properly authenticated. In conjunction with cryptsetup versions older than 2.8.1, the system allows the acceptance of a header indicating the use of the null keyslot encryption algorithm. Consequently, the Contrast Initializer mistakenly assumes that a device is secure if the cryptsetup command succeeds with a secret seed. This flaw enables attackers to access the pod VM, causing sensitive data to be written in plaintext, thus allowing unauthorized access to confidential information that should remain encrypted. Contrast has addressed this issue by shipping cryptsetup 2.8.1 in version 1.12.1, which disables null ciphers when a non-empty passphrase is used, and subsequent updates have added integrity protection to secure persistent storage.

References