CVE-2024-32498

What it actually does

The vulnerability allows an authenticated user to supply a crafted QCOW2 image that references an arbitrary external data file path, causing the system to return the contents of that file, enabling unauthorized access to sensitive data on the server.

Why it matters to the business

Attackers with authenticated access can exfiltrate sensitive files from OpenStack infrastructure, potentially exposing configuration data, credentials, or user information, leading to further compromise or data breaches across all Cinder and Nova deployments and Glance instances with image conversion enabled.

How an attack unfolds

An attacker with valid credentials uploads or registers a malicious QCOW2 image that points to a sensitive file path on the server. When the image is processed by Cinder, Glance (if conversion enabled), or Nova, the system reads and returns the referenced file's contents.

How to fix it

Upgrade OpenStack Cinder to 24.0.1 or later, Glance to 28.0.2 or later, and Nova to 29.0.3 or later. Disable image conversion in Glance if not required.

How to confirm the fix worked

Verify package versions meet or exceed the fixed releases; test by attempting to register a QCOW2 image with an external data reference and confirm the request is rejected or sanitized.

Typical attack path

1. Obtain authenticated access to OpenStack API
2. Craft QCOW2 image with external data file reference to target path
3. Upload or register the image via Cinder, Glance, or Nova
4. Trigger image processing to retrieve and exfiltrate file contents

How to detect it

Review OpenStack service logs for QCOW2 image registrations or conversions that reference external data files; inspect audit logs for unexpected file reads originating from image processing services.

What your security team should do

• Apply updates to Cinder, Glance, and Nova immediately given the stable low EPSS and long time since disclosure
• Restrict image upload and registration privileges to least-privilege accounts
• Disable Glance image conversion unless explicitly needed
• Audit existing QCOW2 images for external data references