Canonical Cloud-Init Root Access Vulnerability on Non-X86 Platforms

A vulnerability in Canonical Cloud-Init has been identified, where root access is granted to a hardcoded URL with a local IP address, but only when a non-x86 platform is detected. This issue arises because Cloud-Init attempts to identify the platform, a feature that is not needed for non-x86 environments. To mitigate this vulnerability, Cloud-Init's default configurations disable platform enumeration.

Impact

Exploitation of this vulnerability allows for unauthorized root access on non-x86 platforms.

Remediation

Users can upgrade to Cloud-Init version 25.1.3, which addresses this vulnerability by preventing the identification of non-x86 OpenStack instances.