CVE-2025-71422 | CVSS: 5.7 | 严重级别: MEDIUM
Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host supplying a crafted LUKS2 volume to a pod VM. LUKS2 volume metadata is not authenticated and, with cryptsetup versions prior to 2.8.1, a header specifying the null keyslot encryption algorithm (cipher_null-ecb) is accepted without error. Because the Contrast Initializer assumes a device is protected if `cryptsetup open` succeeds with the secret seed, the guest will open the attacker-supplied volume and write secret data in plaintext, or
参考链接:
• https://github.com/edgelesssys/contrast/security/advisories/GHSA-f5p4-p5q5-jv3h
• https://www.vulncheck.com/advisories/contrast-before-1.12.1-insecure-luks2-persi
📌 数据来源: NVD 官方