# Constellation has insecure LUKS2 persistent storage partitions which may be opened and used

Malicious host supplies crafted LUKS2 volume with null keyslot cipher to a Constellation confidential VM, which opens it and writes secrets under an attacker-known key.

- Payout: Research
- Severity: high
- Program: Constellation
- Found by: tjade273
- Disclosed: 2025-10-27
- CVE: CVE-2025-58356
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-hq76-6gh2-5g4q
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-hq76-6gh2-5g4q
- Tags: area:cloud domain:cloud impact:data-leak impact:integrity kind:research platform:ghsa sev:high tech:linux technique:source-review vuln:crypto vuln:misconfiguration

**Target:** LUKS2 persistent storage volume / cryptmapper OpenCryptDevice
**Root cause:** LUKS2 header metadata is not authenticated before use, and cryptsetup <2.8.1 accepts the null cipher `cipher_null-ecb` in the keyslot encryption field, so keyslot decryption does not depend on the enclave-held secret.
**Steps:**
1. Attacker (host) crafts a LUKS2 volume whose keyslot `encryption` field is set to `cipher_null-ecb`
2. Volume is presented to the confidential guest using the OpenCryptDevice feature
3. Guest calls `crypt_activate_by_passphrase`; cryptsetup opens the volume without error
4. Guest treats the volume as confidential and writes secret data, which is stored in plaintext or under an attacker-known key
5. Attacker can also pre-load arbitrary data on the device to influence guest execution
**How found:** Researchers examined how Constellation opens LUKS2 volumes and noted that the header is unauthenticated and that cryptsetup 2.8.1 mishandles null keyslot algorithms, allowing a volume to open without depending on the enclave secret.
**Exploitation:** A malicious host provisions a crafted LUKS2 disk with a null keyslot cipher; the CVM opens it via crypt_activate_by_passphrase, believes it confidential, and writes secrets readable by the host, while attacker-chosen preloaded data may compromise guest execution.
**Insight:** When a TEE trusts host-provided storage metadata, check whether the disk header itself is authenticated inside encrypted memory; also audit crypto libraries for accepted null/identity ciphers in keyslot fields.