Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1251271

Bug#1108403: (no subject)

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On 2025-06-27 15:36:26 -0400 (-0400), Noah Meyerhans wrote:
[...]
> There are potential workarounds, but they're not necessarily 
> trivial for users who are operating a cloud environment that they 
> don't control.  The primary workaround is to use a datadrive for 
> VM metadata, rather than a network service, but that's a choice 
> made by the cloud operator.
[...]

I was read in on this back early in the year (in my capacity as an 
OpenStack vulnerability manager even though the vulnerability itself 
doesn't really affect typical OpenStack deployments), but sadly the 
LP bug seems to still be private which makes talking about specific 
mitigations for the vulnerability and workarounds for the new 
behavior difficult. Non-amd64 OpenStack environments are not common, 
though they do exist and I have access to some. This is primarily 
arm64 with maybe a smattering of aging ppc64 and s390x, and I've 
heard tell of riscv experiments in some organizations. That said, 
behavior changes in new versions of software necessitate that users 
ask the operators of their cloud services to make certain new 
configurations possible, I don't see this as being all that 
different if it were just coming in a new major Debian version.

The biggest risk I see with shipping it in stable is that an apt 
upgrade of cloud-init could leave some virtual machines in these 
environments unreachable after a reboot. It's very hard to estimate 
the actual impact due to the various factors involved, as well as 
overall lack of knowledge about the number and sizes of those 
environments. The OpenInfra Foundation does run surveys which 
include questions about some of this (architecture, deployment 
scale...) but it's elective self-reporting so at best only an 
indicator of proportion, assuming related biases don't skew 
responses to the point of complete uselessness in this case.
-- 
Jeremy Stanley

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1108403: cloud-init: CVE-2024-6174 Salvatore Bonaccorso <carnil@debian.org> - 2025-06-27 21:20 +0200
  Bug#1108403: (no subject) Noah Meyerhans <noahm@debian.org> - 2025-06-27 21:40 +0200
    Bug#1108403: (no subject) Jeremy Stanley <fungi@yuggoth.org> - 2025-06-28 02:40 +0200
      Bug#1108403: (no subject) Bastian Blank <waldi@debian.org> - 2025-06-28 10:00 +0200
        Bug#1108403: (no subject) Jeremy Stanley <fungi@yuggoth.org> - 2025-06-28 15:00 +0200
          Bug#1108403: (no subject) thomas@goirand.fr - 2025-06-28 18:30 +0200
            Bug#1108403: cloud-init: CVE-2024-6174 Jeremy Stanley <fungi@yuggoth.org> - 2025-06-29 15:00 +0200
              Bug#1108403: cloud-init: CVE-2024-6174 Bastian Blank <waldi@debian.org> - 2025-06-29 17:40 +0200
                Bug#1108403: cloud-init: CVE-2024-6174 thomas@goirand.fr - 2025-06-29 18:00 +0200
                Bug#1108403: cloud-init: CVE-2024-6174 Bastian Blank <waldi@debian.org> - 2025-06-29 18:40 +0200
  Bug#1108403: cloud-init: CVE-2024-6174 Jeremy Stanley <fungi@yuggoth.org> - 2025-06-30 16:10 +0200
    Bug#1108403: cloud-init: CVE-2024-6174 Jeremy Stanley <fungi@yuggoth.org> - 2025-07-07 20:10 +0200
      Bug#1108403: cloud-init: CVE-2024-6174 Noah Meyerhans <noahm@debian.org> - 2025-07-07 21:00 +0200

csiph-web