High

LUKS2 null-keyslot cipher acceptance in Edgeless Constellation CVM

IdentifiersCVE-2025-58356CWE-345

Edgeless Constellation CVM images use LUKS2-encrypted volumes for persistent storage and rely on libcryptsetup to open those volumes. In the vulnerable design, the CVM calls crypt_activate_by_passphrase and, if activation succeeds with the disk-encryption key, treats the resulting volume as confidential. Due to unsafe handling of null keyslot algorithms in cryptsetup prior to the fixed Constellation release, LUKS2 metadata can be crafted so that a disk using the cipher_null-ecb algorithm in the keyslot encryption field is accepted without error. Because cipher_null-ecb is effectively an identity transform, a maliciously modified LUKS2 header can cause the guest to accept a volume that is not meaningfully encrypted while still appearing valid to the CVM. More broadly, this is part of a class of issues involving malleable LUKS2 metadata headers in confidential VM environments, where an attacker with write access to the backing disk can alter header parameters and subvert confidentiality guarantees.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

An attacker with write access to the encrypted storage backing a Constellation confidential VM can cause the VM to mount and use storage that is effectively unencrypted while the guest believes it is confidential. This can expose plaintext confidential data written to disk and permit arbitrary modification of disk contents. In practice, successful exploitation undermines the confidentiality and integrity guarantees expected from persistent storage in the confidential computing environment.

Mitigation

If you can’t patch tonight, do this now.

If immediate upgrade is not possible, reduce exposure by preventing untrusted parties from obtaining write access to the backing storage device or disk image. Configure attestation consumers to reject pre-patch Constellation versions. Where supported, use detached-header mode to keep the LUKS header out of attacker-controlled storage and protect the header with integrity verification such as a MAC. Additional mitigation can include strict validation of allowed LUKS2 header parameters and measuring sanitized header data into TPM or remote KMS attestation flows. These measures mitigate header tampering but do not replace upgrading to a fixed release.

Remediation

Patch, then assume compromise.

Update Edgeless Constellation to version 2.24.0 or later, which fixes this issue. More generally, deploy versions of the affected confidential computing framework that validate LUKS2 headers before trusting them. Supporting remediations described in the disclosure include protecting the full LUKS header with a MAC where possible, using cryptsetup detached-header mode so the header is sourced from protected memory rather than untrusted disk, performing strict validation of header JSON parameters, and incorporating sanitized header measurements into attestation state so pre-patch or tampered configurations can be rejected.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

trail of bits blogNews

Oct 30, 2025

Vulnerabilities in LUKS2 disk encryption for confidential VMs

One of two CVEs assigned to Trail of Bits' disclosure involving malleable LUKS2 metadata headers in confidential computing systems, enabling an attacker with write access to encrypted disks to cause a guest to use a null cipher and thereby expose or tamper with disk data.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3