PT-2025-37314 · Dtstack · Dstack
Tjade273
·
Published
2025-09-12
·
Updated
2025-11-28
·
CVE-2025-59054
CVSS v4.0
8.5
High
| Vector | AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
dstack versions prior to 0.5.4
Description
dstack is a software development kit (SDK) designed to simplify the deployment of containerized applications into trusted execution environments. In versions prior to 0.5.4, a malicious host can provide a specially crafted LUKS2 data volume to a dstack CVM for use as the
/data mount. This allows the guest operating system to open the volume and write sensitive data using a volume key known to the attacker, potentially leading to the disclosure of Wireguard keys and other secret information. The attacker can also pre-load data onto the device, which could compromise guest execution. The issue stems from the fact that LUKS2 volume metadata is not authenticated and supports null key-encryption algorithms, enabling an attacker to create a volume that opens without error, records all writes in plaintext or with an attacker-known key, and contains arbitrary data chosen by the attacker.Recommendations
Update dstack to version 0.5.4 or later.
Exploit
Fix
Files Accessible to External Parties
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dstack