OpenStack Ironic CVE-2024-44082 Vulnerability Advisory and Patch Guide

From this webpage screenshot, we can extract the following key information about the vulnerability: 1. Vulnerability Description: - CVE ID: CVE-2024-44082 - Affected Versions: Ironic =22.0.0 =23.1.0 =25.0.0 <26.0.1 - Description: A vulnerability exists in Ironic and Ironic-Python-Agent where unvalidated image data is passed to qemu-img, allowing attackers to execute unauthorized actions via malicious images through an authenticated user, potentially leading to unauthorized access to sensitive data. 2. Mitigation Measures: - Patches: Patches have been released to enable Ironic and Ironic-Python-Agent to pre-filter images before passing them to qemu-img. - Configuration Options: In some common deployment configurations, images may bypass the Ironic conductor, resulting in performance degradation. It is recommended to patch both Ironic and Ironic-Python-Agent simultaneously. - Unmaintained Branches: For unmaintained branches (Zed to Victoria), patches for Ironic-Python-Agent are not available due to regression risks. For these branches, the Ironic patch will set to True, which is the only secure way to run Ironic with an unpatched Ironic-Python-Agent. 3. Cached Images: - The Ironic image cache should be cleared. Stop the Ironic conductor and delete files in the directory. 4. Supported Image Formats: - A new configuration option controls which image formats Ironic will accept. By default, allowed formats are and , which are the formats tested by Ironic. Previously, other unsupported formats could be used, but they are now blocked due to security concerns. 5. Warning: - The OpenStack Ironic project does not support using ironic-lib in non-Ironic use cases. In normal supported contexts, ironic-lib assumes images are pre-filtered before interacting with ironic-lib. Therefore, unsupported use of ironic-lib exposes you to the attack described above. 6. Patch Information: - Multiple patches have been released, including patches for both Ironic and Ironic-Python-Agent. 7. References: - Detailed information on CVE-2024-44082. - Launchpad and MITRE CVE pages. 8. Notes: - Calling on untrusted images via unsupported ironic-lib usage is discouraged. - For unmaintained branches, no new point releases will be issued, but patches will be provided as a service. This information provides a detailed description and mitigation guidance for the vulnerability in Ironic involving unvalidated image data being passed to qemu-img.

Goal Reached Thanks to every supporter — we hit 100%!

OpenStack Ironic CVE-2024-44082 Vulnerability Advisory and Patch Guide

More from this source