Ubuntu Cloud Archive

  1. Bug #2059809
  2. Comment #153

Comment 153 for bug 2059809

Revision history for this message
Felix Huettner (felix.huettner) wrote : Re: Arbitrary file access through QCOW2 external data file (CVE-2024-32498)

The issue from the comment before is caused by the cinder NfsDriver (and potentially any other remotefs driver as well). cinder/volume/drivers/nfs.py:initialize_connection calls _qemu_img_info without specifying a format. The then detected format is shared in the connection_info of the attachment which nova then uses as BDM information and to mount the disk.

The same issue might also happen in _copy_volume_from_snapshot for the NFS driver.

There are at least 25 calls to _qemu_img_info in cinder volume that do not provide the expected types.

Maybe we can use the same fix as @danms built for nova