[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <aZSCyyJ82etgzCKm@yuggoth.org>
Date: Tue, 17 Feb 2026 15:01:31 +0000
From: Jeremy Stanley <fungi@...goth.org>
To: oss-security@...ts.openwall.com
Subject: [OSSA-2026-002] OpenStack Nova: calls qemu-img without format
restrictions for resize (CVE-2026-24708)
=========================================================================
OSSA-2026-002: Nova calls qemu-img without format restrictions for resize
=========================================================================
:Date: January 17, 2026
:CVE: CVE-2026-24709
Affects
~~~~~~~
- Nova: <30.2.2, >=31.0.0 <31.2.1, >=32.0.0 <32.1.1
Description
~~~~~~~~~~~
Dan Smith from Red Hat reported a vulnerability in nova. By writing
a malicious QCOW header to a root or ephemeral disk and then
triggering a resize, a user may convince Nova's flat image backend
to call qemu-img without a format restriction resulting in an unsafe
image resize operation that could destroy data on the host system.
Only compute nodes using the Flat image backend (usually configured
with use_cow_images=False) are affected.
Patches
~~~~~~~
- https://review.opendev.org/977104 (2024.2/dalmatian)
- https://review.opendev.org/977103 (2025.1/epoxy)
- https://review.opendev.org/977101 (2025.2/flamingo)
- https://review.opendev.org/977100 (2026.1/gazpacho)
Credits
~~~~~~~
- Dan Smith from Red Hat (CVE-2026-24708)
References
~~~~~~~~~~
- https://launchpad.net/bugs/2137507
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24709
--
Jeremy Stanley
OpenStack Vulnerability Management Team
https://security.openstack.org/vmt.html
Download attachment "signature.asc" of type "application/pgp-signature" (964 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
