CVE-2014-3559
published 2014-08-06CVE-2014-3559: The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is…
PriorityP415low3.5CVSS 2.0
AVNACMAuSCPINAN
EPSS
1.44%
70.1th percentile
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_virtualization | — | — |
CVSS provenance
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:P/I:N/A:N
vendor_redhat3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-24xc-rjq3-m9pj: The oVirt storage backend in Red Hat Enterprise Virtualization 3
ghsa_unreviewed·2022-05-17
CVE-2014-3559 [LOW] GHSA-24xc-rjq3-m9pj: The oVirt storage backend in Red Hat Enterprise Virtualization 3
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.
Red Hat
ovirt-engine-backend: memory snapshots not wiped when deleting a VM with wipe-after-delete (WAD) enabled for its disks
vendor_redhat·2014-08-04·CVSS 3.5
CVE-2014-3559 [LOW] CWE-212 ovirt-engine-backend: memory snapshots not wiped when deleting a VM with wipe-after-delete (WAD) enabled for its disks
ovirt-engine-backend: memory snapshots not wiped when deleting a VM with wipe-after-delete (WAD) enabled for its disks
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.
It was found that the oVirt storage back end did not wipe memory snapshots when VMs were deleted, even if wipe-after-delete (WAD) was enabled for the VM's disks. A remote attacker with credentials to create a new VM could use this flaw to potentially access the contents of memory snapshots in an uninitialized stor
No detection rules found.
No public exploits indexed.
http://rhn.redhat.com/errata/RHSA-2014-1002.htmlhttp://www.securitytracker.com/id/1030664https://bugzilla.redhat.com/show_bug.cgi?id=1121925https://exchange.xforce.ibmcloud.com/vulnerabilities/95098http://rhn.redhat.com/errata/RHSA-2014-1002.htmlhttp://www.securitytracker.com/id/1030664https://bugzilla.redhat.com/show_bug.cgi?id=1121925https://exchange.xforce.ibmcloud.com/vulnerabilities/95098
2014-08-06
Published