CVE-2022-4134

What it actually does

Authorization bypass in OpenStack Glance permits an authenticated user to modify stored images without proper validation, altering image contents that are later used to boot virtual machines.

Why it matters to the business

Organizations running OpenStack may experience integrity failures in launched workloads, leading to potential operational disruptions, compliance issues, and the need for image rebuilds or additional verification steps across large deployments.

How an attack unfolds

An authenticated attacker with Glance access identifies an image, bypasses authorization checks to alter its contents, and then provisions virtual machines from the tampered image, resulting in compromised instances.

How to fix it

Apply the latest OpenStack Glance updates from the distribution vendor as they become available; restrict image modification permissions to trusted service accounts only and enable image signing verification where supported.

How to confirm the fix worked

Review Glance service logs and API audit records for unexpected image update or replace operations; confirm that image checksum or signature validation is enforced on image retrieval and boot operations.

Typical attack path

1. Obtain valid credentials for an account with Glance access
2. Locate a target image via the Glance API
3. Issue a modified image update request that bypasses authorization
4. Upload or replace image data with attacker-controlled content
5. Trigger VM creation or rebuild using the altered image

How to detect it

Examine OpenStack Glance API logs and Keystone audit logs for image-update or image-replace calls from non-admin accounts; look for changes to image checksums or metadata without corresponding service-account activity.

What your security team should do

• Prioritize patching Glance in all OpenStack environments once fixes are released
• Audit current Glance RBAC policies and reduce image write privileges
• Enable and monitor image integrity checks during VM provisioning
• Review authentication and authorization logs for anomalous image modifications