CVE-2025-71422 edgelesssys CVE debrief

Who should care

Defenders responsible for Kubernetes deployments using Contrast should assess exposure and apply remediation to prevent potential data exposure. This includes verifying Contrast version and assessing inventory for potentially vulnerable deployments. Defenders should prioritize verifying exposure of Contrast versions before 1.12.1 and apply vendor remediation.

Why it matters

Defenders should prioritize verifying exposure of Contrast versions before 1.12.1, assessing inventory for potentially vulnerable deployments, and applying vendor remediation to prevent potential data exposure.

• Verification of Contrast version and potential exposure
• Assessment of inventory for vulnerable deployments
• Monitoring for potential exploitation attempts

Technical summary

Contrast, a Kubernetes runtime for confidential containers, has a vulnerability in its secure persistent volume feature. Versions before 1.12.1 are affected, allowing a malicious host to supply a crafted LUKS2 volume to a pod VM, potentially leading to exposure of confidential data. The vulnerability is due to LUKS2 volume metadata not being authenticated, and with cryptsetup versions prior to 2.8.1, a header specifying the null keyslot encryption algorithm (cipher_null-ecb) is accepted without error. Contrast v1.12.1 ships cryptsetup 2.8.1, which disables null ciphers in keyslots when the passphrase is non-empty; v1.13.0 adds detached-header validation in guest memory and integrity protection for secure The 1

Defensive priority

Defenders should prioritize verifying exposure of Contrast versions before 1.12.1, assessing inventory for potentially vulnerable deployments, and applying vendor remediation.

Recommended defensive actions

• Verify Contrast version and apply vendor remediation if necessary
• Assess inventory for potentially vulnerable deployments
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability in Contrast before 1.12.1, including the insecure LUKS2 persistent storage issue and the affected versions. Evidence is limited to CVE Program and source-item records. Defenders should verify Contrast version and assess exposure based on available information. The secure persistent volume feature is vulnerable to a malicious host supplying a crafted LUKS2 volume to a pod VM.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.