[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20240702150121.fxt4445gwlrxwk3r@yuggoth.org>
Date: Tue, 2 Jul 2024 15:01:21 +0000
From: Jeremy Stanley <fungi@...goth.org>
To: oss-security@...ts.openwall.com
Subject: [OSSA-2024-001] OpenStack Cinder, Glance, Nova: Arbitrary file
access through custom QCOW2 external data (CVE-2024-32498)
=======================================================================
OSSA-2024-001: Arbitrary file access through custom QCOW2 external data
=======================================================================
:Date: July 02, 2024
:CVE: CVE-2024-32498
Affects
~~~~~~~
- Cinder: <22.1.3, >=23.0.0 <23.1.1, ==24.0.0
- Glance: <26.0.1, ==27.0.0, >=28.0.0 <28.0.2
- Nova: <27.3.1, >=28.0.0 <28.1.1, >=29.0.0 <29.0.3
Description
~~~~~~~~~~~
Martin Kaesberger reported a vulnerability in QCOW2 image processing
for Cinder, Glance and Nova. By supplying a specially created QCOW2
image which references a specific data file path, an authenticated
user may convince systems to return a copy of that file's contents
from the server resulting in unauthorized access to potentially
sensitive data. All Cinder deployments are affected; only Glance
deployments with image conversion enabled are affected; all Nova
deployments are affected.
Patches
~~~~~~~
- https://review.opendev.org/923247 (2023.1/antelope(cinder))
- https://review.opendev.org/923277 (2023.1/antelope(glance))
- https://review.opendev.org/923278 (2023.1/antelope(glance))
- https://review.opendev.org/923279 (2023.1/antelope(glance))
- https://review.opendev.org/923280 (2023.1/antelope(glance))
- https://review.opendev.org/923281 (2023.1/antelope(glance))
- https://review.opendev.org/923282 (2023.1/antelope(glance))
- https://review.opendev.org/923283 (2023.1/antelope(glance))
- https://review.opendev.org/923288 (2023.1/antelope(nova))
- https://review.opendev.org/923289 (2023.1/antelope(nova))
- https://review.opendev.org/923290 (2023.1/antelope(nova))
- https://review.opendev.org/923281 (2023.1/antelope(nova))
- https://review.opendev.org/923246 (2023.2/bobcat(cinder))
- https://review.opendev.org/923266 (2023.2/bobcat(glance))
- https://review.opendev.org/923267 (2023.2/bobcat(glance))
- https://review.opendev.org/923268 (2023.2/bobcat(glance))
- https://review.opendev.org/923269 (2023.2/bobcat(glance))
- https://review.opendev.org/923270 (2023.2/bobcat(glance))
- https://review.opendev.org/923271 (2023.2/bobcat(glance))
- https://review.opendev.org/923272 (2023.2/bobcat(glance))
- https://review.opendev.org/923284 (2023.2/bobcat(nova))
- https://review.opendev.org/923285 (2023.2/bobcat(nova))
- https://review.opendev.org/923286 (2023.2/bobcat(nova))
- https://review.opendev.org/923287 (2023.2/bobcat(nova))
- https://review.opendev.org/923245 (2024.1/caracal(cinder))
- https://review.opendev.org/923259 (2024.1/caracal(glance))
- https://review.opendev.org/923260 (2024.1/caracal(glance))
- https://review.opendev.org/923261 (2024.1/caracal(glance))
- https://review.opendev.org/923262 (2024.1/caracal(glance))
- https://review.opendev.org/923263 (2024.1/caracal(glance))
- https://review.opendev.org/923264 (2024.1/caracal(glance))
- https://review.opendev.org/923265 (2024.1/caracal(glance))
- https://review.opendev.org/923273 (2024.1/caracal(nova))
- https://review.opendev.org/923274 (2024.1/caracal(nova))
- https://review.opendev.org/923275 (2024.1/caracal(nova))
- https://review.opendev.org/923276 (2024.1/caracal(nova))
- https://review.opendev.org/923244 (2024.2/dalmatian(cinder))
- https://review.opendev.org/923248 (2024.2/dalmatian(glance))
- https://review.opendev.org/923249 (2024.2/dalmatian(glance))
- https://review.opendev.org/923250 (2024.2/dalmatian(glance))
- https://review.opendev.org/923251 (2024.2/dalmatian(glance))
- https://review.opendev.org/923252 (2024.2/dalmatian(glance))
- https://review.opendev.org/923253 (2024.2/dalmatian(glance))
- https://review.opendev.org/923254 (2024.2/dalmatian(glance))
- https://review.opendev.org/923255 (2024.2/dalmatian(nova))
- https://review.opendev.org/923256 (2024.2/dalmatian(nova))
- https://review.opendev.org/923257 (2024.2/dalmatian(nova))
- https://review.opendev.org/923258 (2024.2/dalmatian(nova))
Credits
~~~~~~~
- Martin Kaesberger (CVE-2024-32498)
References
~~~~~~~~~~
- https://launchpad.net/bugs/2059809
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32498
Notes
~~~~~
- Due to the scope of the problem and complexity of the resulting
fixes, regressions and additional bypasses were reported in the
original bug by downstream stakeholders during the coordinated
disclosure period. As a result, our initially chosen publication
date was rescheduled, which put the advisory four days past our
promised ninety day maximum embargo length. Additional revised
patches and regression fixes were supplied to stakeholders as soon
as possible, but we understand the unfortunate timing of these
last-minute changes resulted in a lot of additional work for
everyone involved.
--
Jeremy Stanley
OpenStack Vulnerability Management Team
Download attachment "signature.asc" of type "application/pgp-signature" (964 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
