Groups > linux.debian.bugs.dist > #1251406

Bug#1108403: cloud-init: CVE-2024-6174

From	thomas@goirand.fr
Newsgroups	linux.debian.bugs.dist
Subject	Bug#1108403: cloud-init: CVE-2024-6174
Date	2025-06-29 18:00 +0200
Message-ID	<L32BI-e2ao-7@gated-at.bofh.it> (permalink)
References	(9 earlier) <L2ZNv-e0lY-5@gated-at.bofh.it> <L2mM9-dBPa-1@gated-at.bofh.it> <L32il-e23m-3@gated-at.bofh.it> <L2mM9-dBPa-1@gated-at.bofh.it> <L32il-e23m-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Jun 29, 2025 17:31, Bastian Blank <waldi@debian.org> wrote:

>

> On Sun, Jun 29, 2025 at 12:48:20PM +0000, Jeremy Stanley wrote: 

> > But since we're talking about a very small subset of clouds right now 

> > (specifically those with non-amd64 compute nodes), I think the behavior 

> > change is probably not a major concern. 

>

> Just one.  Debian does not support config drive on ahci, only virtio, 

> when using the smaller genericcloud image. 

>

> Could someone see if openstack could finally fix that broken default? 

>

> Bastian

There's as much as I know, no way to fix the default. Only, operators can add the metadata to the flavor or image. Typically to the image in fact, as the lack of AHCI is really just a Debian specificity. Which is why I filled the bug about re-adding AHCI support in the cloud kernel. I think it is very unfortunate you closed that bug so fast, leaving no room for discution. Because of the we (at infomaniak) switched to the non-cloud kernel fearing some customers trying to boot from server backups would ommit the virtio metadata... :(

Cheers,

Thomas Goirand (zigo)

Thread

Bug#1108403: cloud-init: CVE-2024-6174 Salvatore Bonaccorso <carnil@debian.org> - 2025-06-27 21:20 +0200
  Bug#1108403: (no subject) Noah Meyerhans <noahm@debian.org> - 2025-06-27 21:40 +0200
    Bug#1108403: (no subject) Jeremy Stanley <fungi@yuggoth.org> - 2025-06-28 02:40 +0200
      Bug#1108403: (no subject) Bastian Blank <waldi@debian.org> - 2025-06-28 10:00 +0200
        Bug#1108403: (no subject) Jeremy Stanley <fungi@yuggoth.org> - 2025-06-28 15:00 +0200
          Bug#1108403: (no subject) thomas@goirand.fr - 2025-06-28 18:30 +0200
            Bug#1108403: cloud-init: CVE-2024-6174 Jeremy Stanley <fungi@yuggoth.org> - 2025-06-29 15:00 +0200
              Bug#1108403: cloud-init: CVE-2024-6174 Bastian Blank <waldi@debian.org> - 2025-06-29 17:40 +0200
                Bug#1108403: cloud-init: CVE-2024-6174 thomas@goirand.fr - 2025-06-29 18:00 +0200
                Bug#1108403: cloud-init: CVE-2024-6174 Bastian Blank <waldi@debian.org> - 2025-06-29 18:40 +0200
  Bug#1108403: cloud-init: CVE-2024-6174 Jeremy Stanley <fungi@yuggoth.org> - 2025-06-30 16:10 +0200
    Bug#1108403: cloud-init: CVE-2024-6174 Jeremy Stanley <fungi@yuggoth.org> - 2025-07-07 20:10 +0200
      Bug#1108403: cloud-init: CVE-2024-6174 Noah Meyerhans <noahm@debian.org> - 2025-07-07 21:00 +0200

csiph-web