Vulnerabilities in LUKS2 disk encryption for confidential VMs
Summary: Trail of Bits disclosed vulnerabilities in eight confidential computing systems that use LUKS2 disk encryption, caused by malleable metadata headers that let an attacker with write access to storage disks trick a trusted execution environment guest into encrypting secret data with a null cipher. The CVEs were coordinated with affected projects, and cryptsetup v2.8.1 introduced a partial mitigation that rejects null ciphers as keyslot ciphers when used with a nonempty password, while null ciphers remain valid for volume keys.
What's compelling: An attacker who can observe the header from an encrypted disk formatted with the target CVM's passphrase can hand back a disk that unlocks with any passphrase and runs unencrypted, extracting all confidential data or modifying it arbitrarily - and Trail of Bits says it has no indication the issue has been exploited in the wild, which is not the same as knowing it hasn't.
Read the original at Trail of Bits Blog ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026