CVE-2025-71422 Details

A vulnerability exists in Contrast, a Kubernetes runtime for confidential containers, in versions prior to 1.12.1. The issue arises in the secure persistent volume feature, which can be exploited by a malicious host that supplies a crafted LUKS2 volume to a pod VM. The vulnerability stems from the fact that LUKS2 volume metadata is not authenticated. Additionally, cryptsetup versions prior to 2.8.1 accept headers that specify the null keyslot encryption algorithm without error. The Contrast Initializer assumes a device is protected if the 'cryptsetup open' command succeeds with the secret seed. As a result, the guest VM will open the attacker-supplied volume and write secret data in plaintext or under a volume key known to the attacker. This allows the host to read confidential data that should have been encrypted.

Users can upgrade to Contrast version 1.12.1 or 1.13.0, both of which address this vulnerability by incorporating cryptsetup 2.8.1, which disables null ciphers in keyslots when the passphrase is non-empty. Version 1.13.0 also adds detached-header validation in guest memory and integrity protection for secure persistent storage.