* Fri Jul 04 2025 Miroslav Rezanina <mrezanin@redhat.com> - 24.4-6

- ci-fix-Don-t-attempt-to-identify-non-x86-OpenStack-inst.patch [RHEL-100617] - ci-fix-strict-disable-in-ds-identify-on-no-datasources-.patch [RHEL-100617] - Resolves: RHEL-100617 (CVE-2024-6174 cloud-init: From CVEorg collector [rhel-10.1])
2025-07-04 02:23:53 -04:00 · 2025-07-04 02:23:53 -04:00 · fa222c8310
commit fa222c8310
parent 70415eeead
3 changed files with 276 additions and 1 deletions
--- a/ci-fix-Don-t-attempt-to-identify-non-x86-OpenStack-inst.patch
+++ b/ci-fix-Don-t-attempt-to-identify-non-x86-OpenStack-inst.patch
@ -0,0 +1,176 @@
+From 0dd9ed02e5f8bd4b24ce9840de9973af4576aa98 Mon Sep 17 00:00:00 2001
+From: Brett Holman <brett.holman@canonical.com>
+Date: Thu, 22 Aug 2024 16:54:53 -0600
+Subject: [PATCH 1/2] fix: Don't attempt to identify non-x86 OpenStack
+ instances
+
+RH-Author: Ani Sinha <anisinha@redhat.com>
+RH-MergeRequest: 130: CVE-2024-6174: fix: Don't attempt to identify non-x86 OpenStack instances
+RH-Jira: RHEL-100617
+RH-Acked-by: xiachen <xiachen@redhat.com>
+RH-Commit: [1/2] 8351cf0b538b74f0835d81ddbed1bf8bd4a712d0 (anisinha/cloud-init)
+
+This causes cloud-init to attempt to reach out to the OpenStack Nova
+datasource in non-Nova deployments on non-x86 architectures.
+
+Change default policy of ds-identify to disallow discovery of datasources
+without strict identifiable artifacts in either kernel cmdline, DMI
+platform information or system configuration files. This prevents
+cloud-init from attempting to reach out to well-known hard-codded link-local
+IP addresses for configuration information unless the platform strictly
+identifies as a specific datasource.
+
+CVE-2024-6174
+LP: #2069607
+BREAKING_CHANGE: This may break non-x86 OpenStack Nova users. Affected users
+    may wish to use ConfigDrive as a workaround.
+
+(cherry picked from commit 8c3ae1bb9f1d80fbf217b41a222ee434e7f58900)
+Signed-off-by: Ani Sinha <anisinha@redhat.com>
+---
+ doc/rtd/reference/breaking_changes.rst | 49 ++++++++++++++++++++++++++
+ tests/unittests/test_ds_identify.py    | 13 ++++---
+ tools/ds-identify                      |  8 ++---
+ 3 files changed, 59 insertions(+), 11 deletions(-)
+
+diff --git a/doc/rtd/reference/breaking_changes.rst b/doc/rtd/reference/breaking_changes.rst
+index ce54e1c95..cd425a304 100644
+--- a/doc/rtd/reference/breaking_changes.rst
+++ b/doc/rtd/reference/breaking_changes.rst
+@@ -11,6 +11,54 @@ releases.
+     many operating system vendors patch out breaking changes in
+     cloud-init to ensure consistent behavior on their platform.
+ 
+25.1.3
+======
+
+Strict datasource identity before network
+-----------------------------------------
+Affects detection of Ec2, OpenStack or AltCloud datasources for non-x86
+architectures where DMI may not be accessible.
+
+Datasource detection provided by ds-identify in cloud-init now requires strict
+identification based on DMI platform information, kernel command line or
+`datasource_list:` system configuration in /etc/cloud/cloud.cfg.d.
+
+Prior to this change, ds-identify would allow non-x86 architectures without
+strict identifying platform information to run in a discovery mode which would
+attempt to reach out to well known static link-local IPs to attempt to
+retrieve configuration once system networking is up.
+
+To mitigate the potential of a bad-actor in a local network responding
+to such provisioning requests from cloud-init clients, ds-identify will no
+longer allow this late discovery mode for platforms unable to expose clear
+identifying characteristics of a known cloud-init datasource.
+
+The most likely affected cloud platforms are AltCloud, Ec2 and OpenStack for
+non-x86 architectures where DMI data is not exposed by the kernel.
+
+If your non-x86 architecture or images no longer detect the proper datasource,
+any of the following steps can ensure proper detection of cloud-init config:
+
+- Provide kernel commandline containing ``ds=<lowercase_datasource_name>``
+  which forces ds-identify to discover a specific datasource.
+- Image creators: provide a config file part such as
+  :file:`/etc/cloud/cloud.cfg.d/*.cfg` containing the
+  case-sensitive ``datasource_list: [ <datasource_name> ]`` to force cloud-init
+  to use a specific datasource without performing discovery.
+
+For example, to force OpenStack discovery in cloud-init any of the following
+approaches work:
+
+- OpenStack: `attach a ConfigDrive`_ as an alternative config source
+- Kernel command line containing ``ds=openstack``
+- Custom images provide :file:`/etc/cloud/cloud.cfg.d/91-set-datasource.cfg`
+  containing:
+
+.. code-block:: yaml
+
+   datasource_list: [ OpenStack ]
+
+
+ 24.3
+ ====
+ 
+@@ -148,5 +196,6 @@ Workarounds include updating the kernel command line and optionally configuring
+ a ``datasource_list`` in ``/etc/cloud/cloud.cfg.d/*.cfg``.
+ 
+ 
+.. _attach a ConfigDrive: https://docs.openstack.org/nova/2024.1/admin/config-drive.html
+ .. _this patch: https://github.com/canonical/cloud-init/blob/ubuntu/noble/debian/patches/no-single-process.patch
+ .. _Python3 equivalent:  https://github.com/canonical/cloud-init/pull/5489#issuecomment-2408210561
+diff --git a/tests/unittests/test_ds_identify.py b/tests/unittests/test_ds_identify.py
+index 5d47e552b..9b3828ce6 100644
+--- a/tests/unittests/test_ds_identify.py
+++ b/tests/unittests/test_ds_identify.py
+@@ -208,9 +208,9 @@ system_info:
+ """
+ 
+ POLICY_FOUND_ONLY = "search,found=all,maybe=none,notfound=disabled"
+-POLICY_FOUND_OR_MAYBE = "search,found=all,maybe=all,notfound=disabled"
+-DI_DEFAULT_POLICY = "search,found=all,maybe=all,notfound=disabled"
+-DI_DEFAULT_POLICY_NO_DMI = "search,found=all,maybe=all,notfound=enabled"
+POLICY_FOUND_OR_MAYBE = "search,found=all,maybe=none,notfound=disabled"
+DI_DEFAULT_POLICY = "search,found=all,maybe=none,notfound=disabled"
+DI_DEFAULT_POLICY_NO_DMI = "search,found=all,maybe=none,notfound=enabled"
+ DI_EC2_STRICT_ID_DEFAULT = "true"
+ OVF_MATCH_STRING = "http://schemas.dmtf.org/ovf/environment/1"
+ 
+@@ -937,7 +937,7 @@ class TestDsIdentify(DsIdentifyBase):
+         self._test_ds_found("OpenStack-AssetTag-Compute")
+ 
+     def test_openstack_on_non_intel_is_maybe(self):
+-        """On non-Intel, openstack without dmi info is maybe.
+        """On non-Intel, openstack without dmi info is none.
+ 
+         nova does not identify itself on platforms other than intel.
+         https://bugs.launchpad.net/cloud-init/+bugs?field.tag=dsid-nova"""
+@@ -957,10 +957,9 @@ class TestDsIdentify(DsIdentifyBase):
+ 
+         # updating the uname to ppc64 though should get a maybe.
+         data.update({"mocks": [MOCK_VIRT_IS_KVM, MOCK_UNAME_IS_PPC64]})
+-        (_, _, err, _, _) = self._check_via_dict(
+-            data, RC_FOUND, dslist=["OpenStack", "None"]
+-        )
+        (_, _, err, _, _) = self._check_via_dict(data, RC_NOT_FOUND)
+         self.assertIn("check for 'OpenStack' returned maybe", err)
+        self.assertIn("No ds found", err)
+ 
+     def test_default_ovf_is_found(self):
+         """OVF is identified found when ovf/ovf-env.xml seed file exists."""
+diff --git a/tools/ds-identify b/tools/ds-identify
+index e00b05e80..5644b1e39 100755
+--- a/tools/ds-identify
+++ b/tools/ds-identify
+@@ -14,7 +14,7 @@
+ #   The format is:
+ #        <mode>,found=value,maybe=value,notfound=value
+ #   default setting is:
+-#     search,found=all,maybe=all,notfound=disabled
+#     search,found=all,maybe=none,notfound=disabled
+ #
+ #   kernel command line option: ci.di.policy=<policy>
+ #   example line in /etc/cloud/ds-identify.cfg:
+@@ -40,7 +40,7 @@
+ #         first: use the first found do no further checking
+ #         all: enable all DS_FOUND
+ #
+-#      maybe: (default=all)
+#      maybe: (default=none)
+ #       if nothing returned 'found', then how to handle maybe.
+ #       no network sources are allowed to return 'maybe'.
+ #         all: enable all DS_MAYBE
+@@ -100,8 +100,8 @@ DI_MAIN=${DI_MAIN:-main}
+ 
+ DI_BLKID_EXPORT_OUT=""
+ DI_GEOM_LABEL_STATUS_OUT=""
+-DI_DEFAULT_POLICY="search,found=all,maybe=all,notfound=${DI_DISABLED}"
+-DI_DEFAULT_POLICY_NO_DMI="search,found=all,maybe=all,notfound=${DI_ENABLED}"
+DI_DEFAULT_POLICY="search,found=all,maybe=none,notfound=${DI_DISABLED}"
+DI_DEFAULT_POLICY_NO_DMI="search,found=all,maybe=none,notfound=${DI_ENABLED}"
+ DI_DMI_BOARD_NAME=""
+ DI_DMI_CHASSIS_ASSET_TAG=""
+ DI_DMI_PRODUCT_NAME=""
+-- 
+2.39.3
+
--- a/ci-fix-strict-disable-in-ds-identify-on-no-datasources-.patch
+++ b/ci-fix-strict-disable-in-ds-identify-on-no-datasources-.patch
@ -0,0 +1,89 @@
+From 0f7bc05eafe096f6ee4a623f83425f0f67102704 Mon Sep 17 00:00:00 2001
+From: Chad Smith <chad.smith@canonical.com>
+Date: Tue, 24 Jun 2025 09:12:52 -0600
+Subject: [PATCH 2/2] fix: strict disable in ds-identify on no datasources
+ found
+
+RH-Author: Ani Sinha <anisinha@redhat.com>
+RH-MergeRequest: 130: CVE-2024-6174: fix: Don't attempt to identify non-x86 OpenStack instances
+RH-Jira: RHEL-100617
+RH-Acked-by: xiachen <xiachen@redhat.com>
+RH-Commit: [2/2] c0ad75eee537dd5fa369c446e0fee47591f5f107 (anisinha/cloud-init)
+
+Take the CVE-2024-6174 strict detection fix one step further.
+
+Commit 8c3ae1b took a step to ignore DS_MAYBE datasource discovery.
+But, if no datasources are met the DS_FOUND conditions, ds-identify was
+still leaving cloud-init enabled. This resulted in cloud-init python
+code attempting to discover all datasources later in boot based on
+the default datasource_list.
+
+ds-identify will now assert that at least one datasource is found. If
+no datasources, ds-identify will exit 1 which disables cloud-init boot
+stages and results in no boot configuration operations from cloud-init.
+
+OpenStack images which cannot identify a valid datasource with DMI-data
+or kernel command line ci.ds=OpenStack parameter will need to either:
+- provide image-based configuration in either /etc/cloud/cloud.cfg.* to set
+   datasource_list: [ OpenStack ]
+- provide --config-drive true to openstack server create
+- attach a nocloud disk labelled CIDATA containing user-data and
+  meta-data files
+
+CVE-2024-6174
+LP: #2069607
+
+(cherry picked from commit e3f42adc2674a38fb29e414cfbf96f884934b2d2)
+Signed-off-by: Ani Sinha <anisinha@redhat.com>
+---
+ tests/unittests/test_ds_identify.py | 6 ++++--
+ tools/ds-identify                   | 2 +-
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/tests/unittests/test_ds_identify.py b/tests/unittests/test_ds_identify.py
+index 9b3828ce6..2d6306c2f 100644
+--- a/tests/unittests/test_ds_identify.py
+++ b/tests/unittests/test_ds_identify.py
+@@ -210,7 +210,7 @@ system_info:
+ POLICY_FOUND_ONLY = "search,found=all,maybe=none,notfound=disabled"
+ POLICY_FOUND_OR_MAYBE = "search,found=all,maybe=none,notfound=disabled"
+ DI_DEFAULT_POLICY = "search,found=all,maybe=none,notfound=disabled"
+-DI_DEFAULT_POLICY_NO_DMI = "search,found=all,maybe=none,notfound=enabled"
+DI_DEFAULT_POLICY_NO_DMI = "search,found=all,maybe=none,notfound=disabled"
+ DI_EC2_STRICT_ID_DEFAULT = "true"
+ OVF_MATCH_STRING = "http://schemas.dmtf.org/ovf/environment/1"
+ 
+@@ -947,7 +947,7 @@ class TestDsIdentify(DsIdentifyBase):
+         data.update(
+             {
+                 "policy_dmi": POLICY_FOUND_OR_MAYBE,
+-                "policy_no_dmi": POLICY_FOUND_OR_MAYBE,
+                "policy_no_dmi": DI_DEFAULT_POLICY_NO_DMI,
+             }
+         )
+ 
+@@ -960,6 +960,8 @@ class TestDsIdentify(DsIdentifyBase):
+         (_, _, err, _, _) = self._check_via_dict(data, RC_NOT_FOUND)
+         self.assertIn("check for 'OpenStack' returned maybe", err)
+         self.assertIn("No ds found", err)
+        self.assertIn("Disabled cloud-init", err)
+        self.assertIn("returning 1", err)
+ 
+     def test_default_ovf_is_found(self):
+         """OVF is identified found when ovf/ovf-env.xml seed file exists."""
+diff --git a/tools/ds-identify b/tools/ds-identify
+index 5644b1e39..9bd9c9bbb 100755
+--- a/tools/ds-identify
+++ b/tools/ds-identify
+@@ -101,7 +101,7 @@ DI_MAIN=${DI_MAIN:-main}
+ DI_BLKID_EXPORT_OUT=""
+ DI_GEOM_LABEL_STATUS_OUT=""
+ DI_DEFAULT_POLICY="search,found=all,maybe=none,notfound=${DI_DISABLED}"
+-DI_DEFAULT_POLICY_NO_DMI="search,found=all,maybe=none,notfound=${DI_ENABLED}"
+DI_DEFAULT_POLICY_NO_DMI="search,found=all,maybe=none,notfound=${DI_DISABLED}"
+ DI_DMI_BOARD_NAME=""
+ DI_DMI_CHASSIS_ASSET_TAG=""
+ DI_DMI_PRODUCT_NAME=""
+-- 
+2.39.3
+
--- a/cloud-init.spec
+++ b/cloud-init.spec
@ -6,7 +6,7 @@

 Name:           cloud-init
 Version:        24.4
-Release:        5%{?dist}
+Release:        6%{?dist}
 Summary:        Cloud instance init scripts
 License:        Apache-2.0 OR GPL-3.0-only
 URL:            https://github.com/canonical/cloud-init
@ -28,6 +28,10 @@ Patch9: ci-net-sysconfig-do-not-remove-all-existing-settings-of.patch
 Patch10: ci-fix-NM-reload-and-bring-up-individual-network-conns-.patch
 # For RHEL-88659 - cloudinit backport optimization features on Alibaba Cloud
 Patch11: ci-feat-aliyun-datasource-support-crawl-metadata-at-onc.patch
+# For RHEL-100617 - CVE-2024-6174 cloud-init: From CVEorg collector [rhel-10.1]
+Patch12: ci-fix-Don-t-attempt-to-identify-non-x86-OpenStack-inst.patch
+# For RHEL-100617 - CVE-2024-6174 cloud-init: From CVEorg collector [rhel-10.1]
+Patch13: ci-fix-strict-disable-in-ds-identify-on-no-datasources-.patch

 BuildArch:      noarch

@ -233,6 +237,12 @@ fi


 %changelog
+* Fri Jul 04 2025 Miroslav Rezanina <mrezanin@redhat.com> - 24.4-6
+- ci-fix-Don-t-attempt-to-identify-non-x86-OpenStack-inst.patch [RHEL-100617]
+- ci-fix-strict-disable-in-ds-identify-on-no-datasources-.patch [RHEL-100617]
+- Resolves: RHEL-100617
+  (CVE-2024-6174 cloud-init: From CVEorg collector [rhel-10.1])
+
 * Mon May 12 2025 Miroslav Rezanina <mrezanin@redhat.com> - 24.4-5
 - ci-feat-aliyun-datasource-support-crawl-metadata-at-onc.patch [RHEL-88659]
 - Resolves: RHEL-88659