OSSN-0111: oslo.utils can log LUKS key material (2026-10-22)

Summary

The LUKS inspector in oslo.utils can log cryptographic material when it inspects a LUKSv1 image with a passphrase. This can expose enough key material to decrypt the image.

Affected Services / Software

• oslo.utils (‘>=10.1.0 <10.3.0’)

Discussion

The issue affects deployments only when all of the following are true:

• oslo.utils 10.1.0 or later is deployed.

• The LUKS inspector is called with a passphrase.

• DEBUG logging is enabled for oslo_utils.imageutils._luks.

• The resulting logs are retained or accessible to an unintended party.

The following are logged:

• part of the PBKDF2-derived key

• decrypted LUKS key material

• the full LUKS master-key candidate

• the computed and expected master-key digests

The LUKS passphrase itself is not logged.

When the passphrase passed to the LUKS inspector is correct, the master-key candidate generated by the inspector (and logged) can decrypt the LUKSv1 image. Anyone with access to the logs and a copy of the encrypted image may therefore recover its plaintext contents.

Recommended Actions

Upgrade to a release containing the fix.

If upgrading is not immediately possible, raise the log level for the oslo_utils.imageutils._luks logger above DEBUG until upgraded. This can be done without a code change by adding an entry to the default_log_levels option under [DEFAULT] in the affected service’s configuration file, for example:

[DEFAULT]
default_log_levels = oslo_utils.imageutils._luks=INFO,<existing defaults...>

Note that default_log_levels replaces the service’s built-in default list rather than appending to it, so include the service’s existing default loggers alongside this entry.

Restrict access to logs, log archives, centralized logging systems, and backups.

Review retained logs for previously logged LUKS key material.

If exposure is confirmed, re-encrypt affected images with a new master key or replace them. Applying the fix does not invalidate a key that was already logged.

Patches

• master: https://review.opendev.org/1011661

Credits: Abhishek Kekane, Red Hat

Contacts / References

Author: Abhishek Kekane, Red Hat

• This OSSN : https://docs.openstack.org/security-notes/OSSN-0111.html

• Original LaunchPad Bug : https://bugs.launchpad.net/oslo.utils/+bug/2171574

• Fix : https://review.opendev.org/c/openstack/oslo.utils/+/1011661

• Mailing List : openstack-discuss@lists.openstack.org

• OpenStack Security : https://security.openstack.org/