CVE & CISA-KEV CatalogNVD
CVE-2024-40767
MEDIUM6.5
CVSS v3
Description
In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.
How to fix
Remediation Available
openstack-novaRed Hat / RHEL
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:23.2.3-17.1.20231018123755.el8ostRHSA-2024:5082
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-novaRocky
Fixed in:1:23.2.3-17.1.20231018123755.el8ostRHSA-2024:5082
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-nova-apiRocky
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-nova-apiRed Hat / RHEL
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-nova-commonRed Hat / RHEL
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:23.2.3-17.1.20231018123755.el8ostRHSA-2024:5082
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-nova-commonRocky
Fixed in:1:23.2.3-17.1.20231018123755.el8ostRHSA-2024:5082
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-nova-computeRed Hat / RHEL
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:23.2.3-17.1.20231018123755.el8ostRHSA-2024:5082
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-nova-computeRocky
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:23.2.3-17.1.20231018123755.el8ostRHSA-2024:5082
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-nova-conductorRocky
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-nova-conductorRed Hat / RHEL
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-nova-consoleRocky
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
openstack-nova-consoleRed Hat / RHEL
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
openstack-nova-migrationRed Hat / RHEL
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:23.2.3-17.1.20231018123755.el8ostRHSA-2024:5082
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-nova-migrationRocky
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:23.2.3-17.1.20231018123755.el8ostRHSA-2024:5082
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-nova-novncproxyRed Hat / RHEL
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-nova-novncproxyRocky
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-nova-schedulerRed Hat / RHEL
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-nova-schedulerRocky
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-nova-serialproxyRed Hat / RHEL
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-nova-serialproxyRocky
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-nova-spicehtml5proxyRed Hat / RHEL
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
openstack-nova-spicehtml5proxyRocky
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
python3-novaRed Hat / RHEL
Fixed in:1:23.2.3-17.1.20231018123755.el8ostRHSA-2024:5082
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
python3-novaRocky
Fixed in:1:20.6.2-2.20230814165229.el8ostRHSA-2024:5097
Fixed in:1:20.4.1-1.20221005193235.el8ostRHSA-2024:5113
Fixed in:1:23.2.3-17.1.20231018123755.el8ostRHSA-2024:5082
Fixed in:1:23.2.3-17.1.20231018130829.el9ostRHSA-2024:5083
novaUbuntu
Fixed in:2:21.2.4-0ubuntu2.11USN-6911-1
Fixed in:3:25.2.1-0ubuntu2.6USN-6911-1
Fixed in:3:29.0.1-0ubuntu1.4USN-6911-1
nova-commonUbuntu
Fixed in:2:21.2.4-0ubuntu2.11USN-6911-1
Fixed in:3:25.2.1-0ubuntu2.6USN-6911-1
Fixed in:3:29.0.1-0ubuntu1.4USN-6911-1
python3-novaUbuntu
Fixed in:2:21.2.4-0ubuntu2.11USN-6911-1
Fixed in:3:25.2.1-0ubuntu2.6USN-6911-1
Fixed in:3:29.0.1-0ubuntu1.4USN-6911-1
Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.
CVSS v3 Vector
Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityNone
IntegrityNone
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploit Intelligence
0.94%probability of exploitation in 30 days
57thpercentile
Moderate risk: more likely to be exploited than 57% of all known CVEs.
References
Exploit1
Vendor Advisory2
Mailing List1
Other references1
Related Vulnerabilities
Other CWE-552 vulnerabilities, ordered by exploit likelihood. View all
| CVE | Severity | CVSS | EPSS | Exploited | Fix |
|---|---|---|---|---|---|
| CVE-2020-17519 | High | 7.5 | 98% | KEV | Fix |
| CVE-2025-11371 | High | 7.5 | 92% | KEV | Fix |
| CVE-2023-50164 | Critical | 9.8 | 81% | - | Fix |
| CVE-2016-3715 | Medium | 5.5 | 75% | KEV | Fix |
| CVE-2020-15175 | High | 7.4 | 71% | - | Fix |
| CVE-2021-39316 | High | 7.5 | 67% | - | - |
Embed a live status badge for CVE-2024-40767
Markdown
[](https://tridentstack.com/cve/CVE-2024-40767)HTML
<a href="https://tridentstack.com/cve/CVE-2024-40767"><img src="https://tridentstack.com/cve/badge/CVE-2024-40767.svg" alt="CVE-2024-40767"></a>Find and fix vulnerabilities across your fleet
TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.
Start freeThis product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-11-04.