{"id":70036,"date":"2025-09-12T18:32:21","date_gmt":"2025-09-12T15:02:21","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2025-59054-dstack-has-insecure-luks2-persistent-storage-partitions-that-may-be-opened-and-used\/"},"modified":"2025-09-12T18:32:21","modified_gmt":"2025-09-12T15:02:21","slug":"cve-2025-59054-dstack-has-insecure-luks2-persistent-storage-partitions-that-may-be-opened-and-used","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2025-59054-dstack-has-insecure-luks2-persistent-storage-partitions-that-may-be-opened-and-used\/","title":{"rendered":"CVE-2025-59054 &#8211; dstack has insecure LUKS2 persistent storage partitions that may be opened and used"},"content":{"rendered":"<p><strong>CVE ID : <\/strong>CVE-2025-59054<br \/>\n<br \/>\n<strong>Published : <\/strong> Sept. 12, 2025, 1:15 p.m. | 1\u00a0hour, 28\u00a0minutes ago<br \/>\n<br \/>\n<strong>Description : <\/strong>dstack is a software development kit (SDK) to simplify the deployment of arbitrary containerized apps into trusted execution environments. In versions of dstack prior to 0.5.4, a malicious host may provide a crafted LUKS2 data volume to a dstack CVM for use as the `\/data` mount. The guest will open the volume and write secret data using a volume key known to the attacker, causing disclosure of Wireguard keys and other secret information. The attacker can also pre-load data on the device, which could potentially compromise guest execution. LUKS2 volume metadata is not authenticated and supports null key-encryption algorithms, allowing an attacker to create a volume such that the volume opens (cryptsetup open) without error using any passphrase or token, records all writes in plaintext (or ciphertext with an attacker-known key), and\/or contains arbitrary data chosen by the attacker. Version 0.5.4 of dstack contains a patch that addresses LUKS headers.<br \/>\n<br \/>\n<strong>Severity:<\/strong> 8.5 | HIGH<br \/>\n<br \/>\nVisit the link for more details, such as CVSS details, affected products, timeline, and more&#8230;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE ID : CVE-2025-59054 Published : Sept. 12, 2025, 1:15 p.m. | 1\u00a0hour, 28\u00a0minutes ago Description : dstack is a software development kit (SDK) to simplify the deployment of arbitrary containerized apps into trusted execution environments. In versions of dstack prior to 0.5.4, a malicious host may provide a crafted LUKS2 data volume to a &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-70036","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/70036","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=70036"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/70036\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=70036"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=70036"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=70036"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}