{"cve":"CVE-2025-58356","nvd":{"published":"2025-10-27T20:15:53.480","modified":"2026-10-08T11:10:00.250","status":"Deferred","description":"Constellation is the first Confidential Kubernetes. The Constellation CVM image uses LUKS2-encrypted volumes for persistent storage. When opening an encrypted storage device, the CVM uses the libcryptsetup function crypt_activate_by_passhrase. If the VM is successful in opening the partition with the disk encryption key, it treats the volume as confidential. However, due to the unsafe handling of null keyslot algorithms in the cryptsetup 2.8.1, it is possible that the opened volume is not encrypted at all. Cryptsetup prior to version 2.8.1 does not report an error when processing LUKS2-formatted disks that use the cipher_null-ecb algorithm in the keyslot encryption field. This vulnerability is fixed in 2.24.0.","cvss_v4":{"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.3},"cvss_v3":null,"cwes":["CWE-347"],"references":["https://github.com/edgelesssys/constellation/pull/3927","https://github.com/edgelesssys/constellation/releases/tag/v2.24.0","https://github.com/edgelesssys/constellation/security/advisories/GHSA-hq76-6gh2-5g4q","https://blog.trailofbits.com/2025/10/30/vulnerabilities-in-luks2-disk-encryption-for-confidential-vms/"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:12:35.277909958+00:00"},"epss":{"cve":"CVE-2025-58356","score":0.00107,"percentile":0.01157,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-hq76-6gh2-5g4q","url":"https://osv.dev/vulnerability/GHSA-hq76-6gh2-5g4q","summary":"Constellation has insecure LUKS2 persistent storage partitions which may be opened and used","modified":"2025-12-01T16:21:13.746040Z","packages":[{"ecosystem":"Go","name":"github.com/edgelesssys/constellation/v2","purl":"pkg:golang/github.com/edgelesssys/constellation/v2","ranges":["<2.24.0"],"fixed":["2.24.0"]}]},{"id":"GO-2025-4076","url":"https://osv.dev/vulnerability/GO-2025-4076","summary":"Constellation has insecure LUKS2 persistent storage partitions which may be opened and used in github.com/edgelesssys/constellation","modified":"2026-03-03T04:57:05.424283Z","packages":[{"ecosystem":"Go","name":"github.com/edgelesssys/constellation","purl":"pkg:golang/github.com/edgelesssys/constellation","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/edgelesssys/constellation/v2","purl":"pkg:golang/github.com/edgelesssys/constellation/v2","ranges":["<2.24.0"],"fixed":["2.24.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}