CVE-2024-47211

What it actually does

Missing checksum validation on image_source URLs allows an attacker-supplied image to be fetched and converted to raw format without integrity checks when the convert-to-raw streaming option is enabled.

Why it matters to the business

Attackers can cause availability issues or resource consumption during bare-metal image provisioning in OpenStack environments, potentially disrupting infrastructure deployment workflows.

How an attack unfolds

An attacker identifies an Ironic deployment configured for image conversion, supplies a crafted image_source URL pointing to a malicious or oversized image, and relies on the absence of checksum verification to have the image processed and streamed without detection.

How to fix it

Upgrade OpenStack Ironic to a fixed release containing commit 7a1292c569a84eb05806a57a89fca5bb6b0c4043 (21.4.4, 23.0.3, 24.1.3, or 26.1.0 depending on the branch in use) and ensure checksum validation is enabled for all image sources.

How to confirm the fix worked

Confirm the deployed Ironic version includes the referenced commit, review ironic.conf for image conversion settings, and test image registration with a known-good checksummed source to verify validation occurs.

Typical attack path

1. Identify OpenStack Ironic instances with image conversion to raw enabled
2. Craft and host a malicious or resource-intensive image at an attacker-controlled URL
3. Submit the URL as the image_source parameter in a node deployment or image update request
4. Trigger image fetch and conversion, bypassing any integrity validation
5. Observe denial-of-service effects or unexpected resource usage during streaming

How to detect it

Review Ironic conductor and API logs for image_source URLs originating from unexpected domains, large or repeated conversion jobs, and any image fetch operations that complete without checksum-related log entries.

What your security team should do

• Apply the fixed commit or corresponding release immediately across all Ironic deployments
• Audit configurations to disable convert-to-raw streaming unless strictly required
• Implement network controls restricting image_source URLs to trusted internal registries
• Monitor for new Ironic releases and subscribe to OpenStack security advisories