[<prev] [next>] [day] [month] [year] [list]
Message-ID: <8180962c-b011-4d5c-bddd-a7ee17d5d214@gmail.com>
Date: Thu, 22 Oct 2026 10:12:46 -0400
From: Brian Rosmaita <rosmaita.fossdev@...il.com>
To: oss-security@...ts.openwall.com
Subject: [OSSN-0111] oslo.utils can log LUKS key material
============================================================
OSSN-0111: oslo.utils can log LUKS key material (2026-10-22)
============================================================
Summary
~~~~~~~
The LUKS inspector in oslo.utils can log cryptographic material when it
inspects a LUKSv1 image with a passphrase. This can expose enough key
material to decrypt the image.
Affected Services / Software
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- oslo.utils ('>=10.1.0 <10.3.0')
Discussion
~~~~~~~~~~
The issue affects deployments only when all of the following are true:
- oslo.utils 10.1.0 or later is deployed.
- The LUKS inspector is called with a passphrase.
- DEBUG logging is enabled for ``oslo_utils.imageutils._luks``.
- The resulting logs are retained or accessible to an unintended party.
The following are logged:
- part of the PBKDF2-derived key
- decrypted LUKS key material
- the full LUKS master-key candidate
- the computed and expected master-key digests
The LUKS passphrase itself is not logged.
When the passphrase passed to the LUKS inspector is correct, the
master-key candidate generated by the inspector (and logged) can decrypt
the LUKSv1 image. Anyone with access to the logs and a copy of the
encrypted image may therefore recover its plaintext contents.
Recommended Actions
~~~~~~~~~~~~~~~~~~~
Upgrade to a release containing the fix.
If upgrading is not immediately possible, raise the log level for the
``oslo_utils.imageutils._luks`` logger above DEBUG until upgraded. This
can be done without a code change by adding an entry to the
``default_log_levels`` option under ``[DEFAULT]`` in the affected
service's configuration file, for example::
[DEFAULT]
default_log_levels = oslo_utils.imageutils._luks=INFO,<existing
defaults...>
Note that ``default_log_levels`` replaces the service's built-in default
list rather than appending to it, so include the service's existing
default loggers alongside this entry.
Restrict access to logs, log archives, centralized logging systems, and
backups.
Review retained logs for previously logged LUKS key material.
If exposure is confirmed, re-encrypt affected images with a new master
key or replace them. Applying the fix does not invalidate a key that was
already logged.
**Patches**
- master: https://review.opendev.org/1011661
**Credits:** Abhishek Kekane, Red Hat
Contacts / References
~~~~~~~~~~~~~~~~~~~~~
**Author:** Abhishek Kekane, Red Hat
* This OSSN : https://docs.openstack.org/security-notes/OSSN-0111.html
* Original LaunchPad Bug :
https://bugs.launchpad.net/oslo.utils/+bug/2171574
* Fix : https://review.opendev.org/c/openstack/oslo.utils/+/1011661
* Mailing List : openstack-discuss@...ts.openstack.org
* OpenStack Security : https://security.openstack.org/
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (237 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
