VYPR
← All advisories
Moderate severityNVD Advisory· Published Jan 26, 2023· Updated Mar 31, 2025

CVE-2022-47951

CVE-2022-47951

Description

An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A crafted VMDK flat image can trick OpenStack services (Cinder, Glance, Nova) into leaking arbitrary server files.

Overview

The vulnerability resides in how OpenStack Cinder, Glance, and Nova handle specially crafted VMDK flat image files. By including a reference to an arbitrary backing file path within the VMDK descriptor, an authenticated user can cause these services to read and return the contents of that file from the server's filesystem. This is an arbitrary file read bypass that does not require special administrative privileges beyond normal image upload or block storage creation permissions [1][2][3].

Exploitation

An attacker must first authenticate to the OpenStack environment and have the ability to upload images (to Glance) or create volumes (via Cinder) that will be processed by the compute (Nova) or image services. The exploit relies on crafting a VMDK flat descriptor that points to a target file. When the image is converted, transferred, or used to boot an instance, the vulnerable code will follow the backing file path and serve the contents of that file back to the attacker, effectively bypassing normal file access controls [2][3].

Impact

Successful exploitation allows an authenticated user to read arbitrary files from the server where the service processes the VMDK. This could include sensitive configuration files, credentials (e.g., /etc/passwd, cloud-init secrets, service account keys), or any other host file. The impact is considered critical by OpenStack, as it can lead to complete compromise of the affected services and the underlying host [1][2][3].

Mitigation

Patches have been released for all affected branches: Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. Deployers are strongly advised to upgrade to the fixed versions or apply the patches from the OpenStack gerrit reviews [3]. No workaround is provided, but disabling image conversion in Glance deployments may reduce the attack surface [3].

References
  1. NVD - CVE-2022-47951
  2. Bug #1996188 “[OSSA-2023-002] Arbitrary file access through cust...” : Bugs : OpenStack Compute (nova)
  3. Arbitrary file access through custom VMDK flat descriptor — OpenStack Security Advisories 0.0.1.dev329 documentation

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cinderPyPI
< 19.1.219.1.2
cinderPyPI
>= 20.0.0, < 20.0.220.0.2
glancePyPI
< 23.0.123.0.1
glancePyPI
>= 24.0.0, < 24.1.124.1.1
novaPyPI
< 24.1.224.1.2
novaPyPI
>= 25.0.0, < 25.0.225.0.2

Affected products

90

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.