A high-severity vulnerability in OpenStack Nova allows authenticated users to trigger host-level data destruction through malicious image manipulation.

This flaw, categorized as CWE-669, occurs when the Flat image backend fails to restrict the format during a resize operation. An authenticated user can exploit this by providing a malicious QCOW header, forcing the system to execute qemu-img in an insecure manner.

Successful exploitation leads to the destruction of data on the underlying compute host, posing a critical risk to data integrity and service availability. With a CVSS score of 8.2, this vulnerability represents a significant threat to cloud environments where compute nodes are shared or where tenant isolation is expected. The potential for irreversible loss of host-side data necessitates immediate attention.

Immediate Action: Upgrade OpenStack Nova to versions 30.2.2, 31.2.1, 32.1.1, or later to implement the necessary image format restrictions.

Proactive Monitoring: Monitor compute node logs for unexpected calls to qemu-img or frequent, unusual resize operations initiated by standard user accounts.

Compensating Controls: Ensure compute nodes are configured to avoid the Flat image backend if possible, or restrict image creation capabilities to trusted administrative accounts to reduce the attack surface.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for host-wide data loss, organizations utilizing OpenStack Nova must prioritize the deployment of the provided security patches. Verify your compute node configurations to determine if the Flat image backend is in use, as these systems are at the highest risk. Upgrading the affected software is the only reliable method to eliminate this vulnerability.