Loading vulnerability…
In dstack versions prior to 0.5.4, a malicious host can supply a crafted LUKS2 data volume to a dstack confidential VM for use as the /data mount. Because the guest trusts unauthenticated LUKS2 metadata, an attacker can manipulate the LUKS2 header to use null or attacker-controlled encryption parameters while still allowing the guest to successfully open the volume via cryptsetup. As a result, secret material written by the guest to the mounted volume, including WireGuard keys and other sensitive data, may be stored in plaintext or under a key known to the attacker. The attacker may also pre-populate the device with arbitrary content before it is mounted, potentially influencing guest execution. The issue stems from accepting untrusted, unauthenticated LUKS2 metadata from host-controlled storage in a confidential-computing deployment.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.