CVE-2025-58356: Constellation has insecure LUKS2 persistent storage partitions which may be opened and used

A malicious host may provide a crafted LUKS2 volume to a confidential computing guest that is using the OpenCryptDevice feature. The guest will open the volume and write secret data using a volume key known to the attacker. The attacker can also pre-load data on the device, which could potentially compromise guest execution.

LUKS2 volume metadata is not authenticated and supports null key-encryption algorithms, allowing an attacker to create a volume such that the volume:

• Opens (cryptsetup open) without error using any passphrase or token
• Records all writes in plaintext (or ciphertext with an attacker-known key)
• Contains arbitrary data chosen by the attacker