CVE-2024-29008: Apache CloudStack: The extraconfig feature can be abused to load hypervisor resources on a VM instance

Published Apr 4, 2024
·
Updated

A problem has been identified in the CloudStack additional VM configuration (extraconfig) feature which can be misused by anyone who has privilege to deploy a VM instance or configure settings of an already deployed VM instance, to configure additional VM configuration even when the feature is not explicitly enabled by the administrator. In a KVM based CloudStack environment, an attacker can exploit this issue to attach host devices such as storage disks, and PCI and USB devices such as network adapters and GPUs, in a regular VM instance that can be further exploited to gain access to the underlying network and storage infrastructure resources, and access any VM instance disks on the local storage.

Users are advised to upgrade to version 4.18.1.1 or 4.19.0.1, which fixes this issue.

Affected Software

3 affected components
Apache CloudStack<4.18.1.1, <4.19.0.1
Apache CloudStack>=4.14.0.0<4.18.1.1
Apache CloudStack=4.19.0.0

Event History

Apr 4, 2024
CVE Published
via MITRE·07:51 AM
Data Sourced
via MITRE·07:51 AM
DescriptionWeakness
Data Sourced
via NVD·08:15 AM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-29008?

CVE-2024-29008 has been assessed as a medium severity vulnerability due to its potential misuse by privileged users.

2

How do I fix CVE-2024-29008?

To fix CVE-2024-29008, update Apache CloudStack to version 4.18.1.2 or 4.19.0.2 or later.

3

Who is affected by CVE-2024-29008?

CVE-2024-29008 affects Apache CloudStack versions prior to 4.18.1.2 and 4.19.0.2.

4

What functions are impacted by CVE-2024-29008?

CVE-2024-29008 impacts the extraconfig feature, allowing unauthorized configuration of virtual machine instances.

5

Can CVE-2024-29008 be exploited remotely?

CVE-2024-29008 can potentially be exploited by authenticated users with privileges to deploy or configure VM instances.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203