OSSA-2025-001: Ironic fails to restrict paths used for file:// image URLs

Date:

May 08, 2024

CVE:

CVE-2025-44021

Affects

  • Ironic: <24.1.3, >=25.0.0 <26.1.1, >=27.0.0, <29.0.1

Description

Julia Kreger of Red Hat noticed a vulnerability in image handling for Ironic. A malicious project assigned as a node owner can provide a path to any local file readable by the ironic-conductor which may then be written to the target node disk. This is only possible via deployments performed directly via Ironic’s API and cannot be triggered via Nova’s virt driver.

This is difficult to exploit in practice, as a node deployed in this manner should not ever reach ACTIVE state, but it still represents a danger in environments running with non-default, insecure configurations such as with automated cleaning disabled.

Patches

Credits

  • Julia Kreger from Red Hat (C, V, E, -, 2, 0, 2, 5, -, 4, 4, 0, 2, 1)

References

Notes

  • Patches have been provided for all supported Ironic branches. As a courtesy, we have also provided patches for some unmaintained branches and the recently end-of-life 2023.2/bobcat release. As usual, we will provide updated releases off maintained branches, but will not create new releases off bugfix or unmaintained branches.