CVE-2024-28718: 
Python vulnerability analysis and mitigation

OpenStack Magnum yoga-eom version contains a Time-of-Check-Time-of-Use (TOCTOU) vulnerability in the cert_manager.py component that allows remote attackers to execute arbitrary code. The vulnerability was discovered in December 2023 and was assigned CVE-2024-28718. The issue affects the certificate management functionality in OpenStack Magnum (Launchpad Bug, NVD).

The vulnerability stems from a race condition in the certificate management component where file permissions are set after writing sensitive data. Specifically, in cert_manager.py, the code first writes certificate files (ca_file, key_file, cert_file) and then changes their permissions using chmod to 0o600. This creates a time window between file creation and permission modification where the files are potentially accessible to unauthorized users. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could allow attackers to access sensitive certificate data during the window between file creation and permission modification. This could potentially lead to the compromise of certificate private keys and other sensitive cryptographic material, ultimately enabling arbitrary code execution (Launchpad Bug).

The vulnerability is remotely exploitable and requires no user interaction or special privileges. The TOCTOU race condition can be exploited by timing attacks that take advantage of the window between file creation and permission modification (Gist Details).

The issue has been fixed by modifying the code to set file permissions before writing sensitive data. The fix has been merged into multiple branches including master, stable/2023.2, stable/2023.1, stable/zed, and stable/yoga. The fix is included in OpenStack Magnum versions 14.1.2, 15.0.2, 16.0.2, 17.0.2, and 18.0.0.0rc1 (Launchpad Bug).