oss-security - [OSSA-2026-002] OpenStack Nova: calls qemu-img without format restrictions for resize (CVE-2026-24708) errata 1

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aZSudt6OT1un6jBM@yuggoth.org>
Date: Tue, 17 Feb 2026 18:07:50 +0000
From: Jeremy Stanley <fungi@...goth.org>
To: oss-security@...ts.openwall.com
Subject: [OSSA-2026-002] OpenStack Nova: calls qemu-img without format
 restrictions for resize (CVE-2026-24708) errata 1

=========================================================================
OSSA-2026-002: Nova calls qemu-img without format restrictions for resize
=========================================================================

:Date: January 17, 2026
:CVE: CVE-2026-24708

Affects
~~~~~~~
- Nova: <30.2.2, >=31.0.0 <31.2.1, >=32.0.0 <32.1.1

Description
~~~~~~~~~~~
Dan Smith from Red Hat reported a vulnerability in nova. By writing 
a malicious QCOW header to a root or ephemeral disk and then 
triggering a resize, a user may convince Nova's flat image backend 
to call qemu-img without a format restriction resulting in an unsafe 
image resize operation that could destroy data on the host system. 
Only compute nodes using the Flat image backend (usually configured 
with use_cow_images=False) are affected.

Errata
~~~~~~
The original advisory incorrectly referred and linked to 
CVE-2026-24709 in some places, but CVE-2026-24708 is the correct 
identifier.

Patches
~~~~~~~
- https://review.opendev.org/977104 (2024.2/dalmatian)
- https://review.opendev.org/977103 (2025.1/epoxy)
- https://review.opendev.org/977101 (2025.2/flamingo)
- https://review.opendev.org/977100 (2026.1/gazpacho)

Credits
~~~~~~~
- Dan Smith from Red Hat (CVE-2026-24708)

References
~~~~~~~~~~
- https://launchpad.net/bugs/2137507
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24708

OSSA History
~~~~~~~~~~~~
- 2026-02-17 - Errata 1
- 2026-02-17 - Original Version

-- 
Jeremy Stanley
OpenStack Vulnerability Management Team
https://security.openstack.org/vmt.html

Download attachment "signature.asc" of type "application/pgp-signature" (964 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.