|
| 1 | +From 161590728c951b933885ef40e664b9db9e585566 Mon Sep 17 00:00:00 2001 |
| 2 | +From: archana25-ms < [email protected]> |
| 3 | +Date: Fri, 27 Jun 2025 10:54:59 +0000 |
| 4 | +Subject: [PATCH] Address CVE-2024-6174 |
| 5 | +Upstream Patch Reference: https://github.com/canonical/cloud-init/commit/8c3ae1bb9f1d80fbf217b41a222ee434e7f58900 |
| 6 | + |
| 7 | +--- |
| 8 | + doc/rtd/reference/breaking_changes.rst | 48 ++++++++++++++++++++++++++ |
| 9 | + tests/unittests/test_ds_identify.py | 13 ++++--- |
| 10 | + tools/ds-identify | 8 ++--- |
| 11 | + 3 files changed, 58 insertions(+), 11 deletions(-) |
| 12 | + |
| 13 | +diff --git a/doc/rtd/reference/breaking_changes.rst b/doc/rtd/reference/breaking_changes.rst |
| 14 | +index 0eba443..6fab8e5 100644 |
| 15 | +--- a/doc/rtd/reference/breaking_changes.rst |
| 16 | ++++ b/doc/rtd/reference/breaking_changes.rst |
| 17 | +@@ -11,6 +11,54 @@ releases. |
| 18 | + many operating system vendors patch out breaking changes in |
| 19 | + cloud-init to ensure consistent behavior on their platform. |
| 20 | + |
| 21 | ++24.3.1 |
| 22 | ++====== |
| 23 | ++ |
| 24 | ++Strict datasource identity before network |
| 25 | ++----------------------------------------- |
| 26 | ++Affects detection of Ec2, OpenStack or AltCloud datasources for non-x86 |
| 27 | ++architectures where DMI may not be accessible. |
| 28 | ++ |
| 29 | ++Datasource detection provided by ds-identify in cloud-init now requires strict |
| 30 | ++identification based on DMI platform information, kernel command line or |
| 31 | ++`datasource_list:` system configuration in /etc/cloud/cloud.cfg.d. |
| 32 | ++ |
| 33 | ++Prior to this change, ds-identify would allow non-x86 architectures without |
| 34 | ++strict identifying platform information to run in a discovery mode which would |
| 35 | ++attempt to reach out to well known static link-local IPs to attempt to |
| 36 | ++retrieve configuration once system networking is up. |
| 37 | ++ |
| 38 | ++To mitigate the potential of a bad-actor in a local network responding |
| 39 | ++to such provisioning requests from cloud-init clients, ds-identify will no |
| 40 | ++longer allow this late discovery mode for platforms unable to expose clear |
| 41 | ++identifying characteristics of a known cloud-init datasource. |
| 42 | ++ |
| 43 | ++The most likely affected cloud platforms are AltCloud, Ec2 and OpenStack for |
| 44 | ++non-x86 architectures where DMI data is not exposed by the kernel. |
| 45 | ++ |
| 46 | ++If your non-x86 architecture or images no longer detect the proper datasource, |
| 47 | ++any of the following steps can ensure proper detection of cloud-init config: |
| 48 | ++ |
| 49 | ++- Provide kernel commandline containing ``ds=<lowercase_datasource_name>`` |
| 50 | ++ which forces ds-identify to discover a specific datasource. |
| 51 | ++- Image creators: provide a config file part such as |
| 52 | ++ :file:`/etc/cloud/cloud.cfg.d/*.cfg` containing the |
| 53 | ++ case-sensitive ``datasource_list: [ <datasource_name> ]`` to force cloud-init |
| 54 | ++ to use a specific datasource without performing discovery. |
| 55 | ++ |
| 56 | ++For example, to force OpenStack discovery in cloud-init any of the following |
| 57 | ++approaches work: |
| 58 | ++ |
| 59 | ++- OpenStack: `attach a ConfigDrive`_ as an alternative config source |
| 60 | ++- Kernel command line containing ``ds=openstack`` |
| 61 | ++- Custom images provide :file:`/etc/cloud/cloud.cfg.d/91-set-datasource.cfg` |
| 62 | ++ containing: |
| 63 | ++ |
| 64 | ++.. code-block:: yaml |
| 65 | ++ |
| 66 | ++ datasource_list: [ OpenStack ] |
| 67 | ++ |
| 68 | ++ |
| 69 | + 24.3 |
| 70 | + ==== |
| 71 | + |
| 72 | +diff --git a/tests/unittests/test_ds_identify.py b/tests/unittests/test_ds_identify.py |
| 73 | +index d8f10c1..d2b0f87 100644 |
| 74 | +--- a/tests/unittests/test_ds_identify.py |
| 75 | ++++ b/tests/unittests/test_ds_identify.py |
| 76 | +@@ -208,9 +208,9 @@ system_info: |
| 77 | + """ |
| 78 | + |
| 79 | + POLICY_FOUND_ONLY = "search,found=all,maybe=none,notfound=disabled" |
| 80 | +-POLICY_FOUND_OR_MAYBE = "search,found=all,maybe=all,notfound=disabled" |
| 81 | +-DI_DEFAULT_POLICY = "search,found=all,maybe=all,notfound=disabled" |
| 82 | +-DI_DEFAULT_POLICY_NO_DMI = "search,found=all,maybe=all,notfound=enabled" |
| 83 | ++POLICY_FOUND_OR_MAYBE = "search,found=all,maybe=none,notfound=disabled" |
| 84 | ++DI_DEFAULT_POLICY = "search,found=all,maybe=none,notfound=disabled" |
| 85 | ++DI_DEFAULT_POLICY_NO_DMI = "search,found=all,maybe=none,notfound=enabled" |
| 86 | + DI_EC2_STRICT_ID_DEFAULT = "true" |
| 87 | + OVF_MATCH_STRING = "http://schemas.dmtf.org/ovf/environment/1" |
| 88 | + |
| 89 | +@@ -937,7 +937,7 @@ class TestDsIdentify(DsIdentifyBase): |
| 90 | + self._test_ds_found("OpenStack-AssetTag-Compute") |
| 91 | + |
| 92 | + def test_openstack_on_non_intel_is_maybe(self): |
| 93 | +- """On non-Intel, openstack without dmi info is maybe. |
| 94 | ++ """On non-Intel, openstack without dmi info is none. |
| 95 | + |
| 96 | + nova does not identify itself on platforms other than intel. |
| 97 | + https://bugs.launchpad.net/cloud-init/+bugs?field.tag=dsid-nova""" |
| 98 | +@@ -957,10 +957,9 @@ class TestDsIdentify(DsIdentifyBase): |
| 99 | + |
| 100 | + # updating the uname to ppc64 though should get a maybe. |
| 101 | + data.update({"mocks": [MOCK_VIRT_IS_KVM, MOCK_UNAME_IS_PPC64]}) |
| 102 | +- (_, _, err, _, _) = self._check_via_dict( |
| 103 | +- data, RC_FOUND, dslist=["OpenStack", "None"] |
| 104 | +- ) |
| 105 | ++ (_, _, err, _, _) = self._check_via_dict(data, RC_NOT_FOUND) |
| 106 | + self.assertIn("check for 'OpenStack' returned maybe", err) |
| 107 | ++ self.assertIn("No ds found", err) |
| 108 | + |
| 109 | + def test_default_ovf_is_found(self): |
| 110 | + """OVF is identified found when ovf/ovf-env.xml seed file exists.""" |
| 111 | +diff --git a/tools/ds-identify b/tools/ds-identify |
| 112 | +index 606be9c..bfc8db4 100755 |
| 113 | +--- a/tools/ds-identify |
| 114 | ++++ b/tools/ds-identify |
| 115 | +@@ -14,7 +14,7 @@ |
| 116 | + # The format is: |
| 117 | + # <mode>,found=value,maybe=value,notfound=value |
| 118 | + # default setting is: |
| 119 | +-# search,found=all,maybe=all,notfound=disabled |
| 120 | ++# search,found=all,maybe=none,notfound=disabled |
| 121 | + # |
| 122 | + # kernel command line option: ci.di.policy=<policy> |
| 123 | + # example line in /etc/cloud/ds-identify.cfg: |
| 124 | +@@ -40,7 +40,7 @@ |
| 125 | + # first: use the first found do no further checking |
| 126 | + # all: enable all DS_FOUND |
| 127 | + # |
| 128 | +-# maybe: (default=all) |
| 129 | ++# maybe: (default=none) |
| 130 | + # if nothing returned 'found', then how to handle maybe. |
| 131 | + # no network sources are allowed to return 'maybe'. |
| 132 | + # all: enable all DS_MAYBE |
| 133 | +@@ -100,8 +100,8 @@ DI_MAIN=${DI_MAIN:-main} |
| 134 | + |
| 135 | + DI_BLKID_EXPORT_OUT="" |
| 136 | + DI_GEOM_LABEL_STATUS_OUT="" |
| 137 | +-DI_DEFAULT_POLICY="search,found=all,maybe=all,notfound=${DI_DISABLED}" |
| 138 | +-DI_DEFAULT_POLICY_NO_DMI="search,found=all,maybe=all,notfound=${DI_ENABLED}" |
| 139 | ++DI_DEFAULT_POLICY="search,found=all,maybe=none,notfound=${DI_DISABLED}" |
| 140 | ++DI_DEFAULT_POLICY_NO_DMI="search,found=all,maybe=none,notfound=${DI_ENABLED}" |
| 141 | + DI_DMI_BOARD_NAME="" |
| 142 | + DI_DMI_CHASSIS_ASSET_TAG="" |
| 143 | + DI_DMI_PRODUCT_NAME="" |
| 144 | +-- |
| 145 | +2.45.3 |
| 146 | + |
0 commit comments