Lack of checksum validation on images
CVE: CVE-2024-47211
Component: openstack-ironic
CWE: CWE-354
Severity: Moderate
CVSS v3: 6.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Release date: 2024-10-03T15:00:00+00:00

A flaw was found in OpenStack Ironic. The lack of checksum verification allows an attacker with access to the images to modify an image without the change noticed by OpenStack. This issue leads to integrity issues in the image.

Statement: This vulnerability is classified as moderate severity rather than important because it requires a specific set of conditions for exploitation. An attacker must have access to the image source and be positioned to intercept or modify images during their transmission, which limits the attack surface to environments with insecure or untrusted network configurations. Additionally, the vulnerability only impacts Ironic when it is configured to convert images to raw format for streaming, making it a less common scenario. The absence of checksum validation could compromise image integrity, but it does not grant direct control over the system or immediate escalation of privileges, hence the moderate classification.

Red Hat OpenStack 16.2 is not affected by this vulnerability, as it doesn't contain the affected code and the needed configuration option required to a successful exploit.

Remediation:
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:91167e05309698940a16cfb80096772100fdd7c612bee4b84084b1deb26d562a

      (For s390x architecture)
      The image digest is sha256:bf0f76c2f460aceb7bff00bb52bf7741da2bd4cd2b6090f2d1fddf145b1d4ce1

      (For ppc64le architecture)
      The image digest is sha256:cc7bac5a4058b58b4e715967f0b90016b581485ab85c55f941a3cebf85da9f9c

      (For aarch64 architecture)
      The image digest is sha256:fc8b5ba9f694bdee0fb5329c4f8f74ce5736a017d44029eb0c561566171feab5

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:e63e11532f9ee550219f076530ce449a5e2ce6f6179e5ccdaf55ce68092e7021

      (For s390x architecture)
      The image digest is sha256:15561e9bef74ea74bb2bdffe9070614b6d1d0c1f77d436770d2f96240d8b85f2

      (For ppc64le architecture)
      The image digest is sha256:c65c528b7d7e09dfbe91dfc45d782687155ec7f07f83030922f349ab0be94d2b

      (For aarch64 architecture)
      The image digest is sha256:7b544fb8fd674d403030cb26fa41780896f578aa83a23c35474918308aef4a1f

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.17/updating/updating_a_cluster/updating-cluster-cli.html
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update as a new RHOSO 18.0 deployment, see “Deploying Red Hat OpenStack Services on OpenShift” at https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html/deploying_red_hat_openstack_services_on_openshift/index

For details on how to apply this update to an existing RHOSO 18.0 deployment, see "Updating your environment to the latest maintenance release" at https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html/updating_your_environment_to_the_latest_maintenance_release/index
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.