CVE-2024-40767: [OSSA-2024-002] OpenStack Nova: Incomplete file access fix and gssion for QCOW2 backing files and VMDK flat descriptors (CVE-2024-40767)
Arnaud Morin (OVH) reported a vulnerability in Nova. By supplying a raw format image which is actually a specially crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file’s contents from the server resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected.
Other sources
In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.
— Debian
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40767?
The severity of CVE-2024-40767 is considered moderate, given its potential impact on system security when exploiting crafted image files.
How do I fix CVE-2024-40767?
To remediate CVE-2024-40767, upgrade Nova to a version that is not affected, such as 29.0.2-4 or higher.
Who reported the CVE-2024-40767 vulnerability?
The CVE-2024-40767 vulnerability was reported by Arnaud Morin from OVH.
What versions of Nova are impacted by CVE-2024-40767?
CVE-2024-40767 affects Nova versions from 27.0.0 up to 29.1.0.
Can an authenticated user exploit CVE-2024-40767?
Yes, an authenticated user can exploit CVE-2024-40767 by supplying specially crafted QCOW2 or VMDK images to the system.