OpenStack Nova: crafted QCOW header on a Flat-backend disk lets a tenant destroy host data on resize

Impact

A tenant who can write to their own root or ephemeral disk can plant a malicious QCOW header and then request a resize. Nova's Flat image backend invokes qemu-img without pinning the input format, so qemu-img honours the attacker's header instead of treating the disk as raw, and the resize can write outside the instance's own file and destroy data on the compute host. On a GPU compute node that means damage to host filesystem state shared by every other instance on the box, including co-tenant disks - integrity and availability loss with no confidentiality gain. Only compute nodes running the Flat image backend, normally use_cow_images=False, are affected; qcow2 and Ceph-backed nodes are not.

Who can reach it

Any authenticated tenant with an instance on an affected compute node - they need only the ability to write to their own disk and call the resize API. No host access and no admin role required, but the node must be using the Flat image backend.

What to do

Upgrade Nova to 30.2.2, 31.2.1 or 32.1.1 (or the vendor build: RHSA-2026:54757, RHSA-2026:66401) and restart the nova-compute service on every affected node; a rolling restart is enough, instances keep running. If you cannot patch immediately, the exposure is confined to nodes with use_cow_images=False, so switching those nodes to the qcow2 or Ceph backend, or blocking resize on them, removes the path. The advisory names fixed versions only; no host reboot is indicated.

References

Related entries

• Linux kernel (drivers/iommu/intel): A device that does not support ATS never gets inserted into the VT-d deviceCVE-2026-74355 · Linux kernel (drivers/iommu/intel)High
• Linux kernel (arch/x86/kvm/svm): If AVIC is inhibited while a nested guest is running, KVM leaves the x2APIC MSRsCVE-2026-74516 · Linux kernel (arch/x86/kvm/svm)High
• Linux kernel (net/tls): When a NIC with active kTLS offload goes down, the offload teardown freed the TLS context whileCVE-2021-47131 · Linux kernel (net/tls)High
• VMware ESXi / Workstation / Fusion (storage controller out-of-bounds read/write): A malicious actor inside a VMCVE-2024-22273 · VMware ESXi / Workstation / Fusion (storage controller out-of-bounds read/write)High
• Linux kernel (net/xfrm): The error path of xfrm_input leaves the secpath entry pointing at poisoned memory, and theCVE-2024-43878 · Linux kernel (net/xfrm)High
• Linux kernel NVMe target authentication (nvmet-auth DH group setup): CtrlCVE-2024-50215 · Linux kernel NVMe target authentication (nvmet-auth DH group setup)High