CVE-2024-29008: Apache CloudStack: The extraconfig feature can be abused to load hypervisor resources on a VM instance
A problem has been identified in the CloudStack additional VM configuration (extraconfig) feature which can be misused by anyone who has privilege to deploy a VM instance or configure settings of an already deployed VM instance, to configure additional VM configuration even when the feature is not explicitly enabled by the administrator. In a KVM based CloudStack environment, an attacker can exploit this issue to attach host devices such as storage disks, and PCI and USB devices such as network adapters and GPUs, in a regular VM instance that can be further exploited to gain access to the underlying network and storage infrastructure resources, and access any VM instance disks on the local storage.
Users are advised to upgrade to version 4.18.1.1 or 4.19.0.1, which fixes this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29008?
CVE-2024-29008 has been assessed as a medium severity vulnerability due to its potential misuse by privileged users.
How do I fix CVE-2024-29008?
To fix CVE-2024-29008, update Apache CloudStack to version 4.18.1.2 or 4.19.0.2 or later.
Who is affected by CVE-2024-29008?
CVE-2024-29008 affects Apache CloudStack versions prior to 4.18.1.2 and 4.19.0.2.
What functions are impacted by CVE-2024-29008?
CVE-2024-29008 impacts the extraconfig feature, allowing unauthorized configuration of virtual machine instances.
Can CVE-2024-29008 be exploited remotely?
CVE-2024-29008 can potentially be exploited by authenticated users with privileges to deploy or configure VM instances.