GHSA-f5p4-p5q5-jv3h: Contrast has insecure LUKS2 persistent storage partitions may be opened and used

A malicious host may provide a crafted LUKS2 volume to a Contrast pod VM that uses the secure persistent volume feature. The guest will open the volume and write secret data using a volume key known to the attacker.

LUKS2 volume metadata is (a) not authenticated and (b) supports null key-encryption algorithms, allowing an attacker to create a volume such that the volume:

• Opens (cryptsetup open) without error using any passphrase or token
• Records all writes in plaintext (or ciphertext with an attacker-known key)