OpenStack oslo.utils: Information exposure of LUKS key material

The oslo.utils library, a common utility component in OpenStack, contains a security flaw in its LUKS inspector functionality. When the library processes a LUKSv1 image protected by a passphrase, it may inadvertently log the cryptographic key material to system logs. This exposure provides sufficient data for an unauthorized actor with access to log files to decrypt the affected disk images.

Impact

The primary impact is the unauthorized exposure of disk encryption keys in system logs. This allows for potential full data decryption of LUKSv1 volumes if logs are intercepted or improperly secured.

Recommendation

• Audit system and application log repositories for the presence of cryptographic material or unexpected debugging output from oslo.utils.
• Review OpenStack or service-specific security advisories for patches addressing this library.
• Apply restricted access controls to log aggregation platforms to prevent unauthorized access to potentially sensitive log entries.