CVE-2018-1062
published 2018-03-06CVE-2018-1062: A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt…
PriorityP426medium5.3CVSS 3.1
AVNACHPRLUINSUCHINAN
EPSS
1.37%
68.6th percentile
A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk attached to another VM, potentially sensitive data could be revealed to privileged users of that VM.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ovirt | ovirt | — | — |
| redhat | ovirt-engine | >= 4.1.0 < 4.1.9 | 4.1.9 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:P/I:N/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ovirt-engine: When Wipe After Delete (WAD) and Enable Discard are both enabled for a VM disk, discarded data might not be wiped after the disk is removed.
vendor_redhat·2018-03-06·CVSS 5.3
CVE-2018-1062 [MEDIUM] CWE-212 ovirt-engine: When Wipe After Delete (WAD) and Enable Discard are both enabled for a VM disk, discarded data might not be wiped after the disk is removed.
ovirt-engine: When Wipe After Delete (WAD) and Enable Discard are both enabled for a VM disk, discarded data might not be wiped after the disk is removed.
A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk attached to another VM, potentially sensitive data could be revealed to privileged users of that VM.
It was discovered that the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to
GHSA
GHSA-j45v-g64g-45w2: A vulnerability was discovered in oVirt 4
ghsa_unreviewed·2022-05-13
CVE-2018-1062 [MEDIUM] CWE-212 GHSA-j45v-g64g-45w2: A vulnerability was discovered in oVirt 4
A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk attached to another VM, potentially sensitive data could be revealed to privileged users of that VM.
No detection rules found.
http://www.securityfocus.com/bid/103433https://access.redhat.com/errata/RHBA-2018:0135https://bugzilla.redhat.com/show_bug.cgi?id=1549944https://gerrit.ovirt.org/#/c/84861/https://gerrit.ovirt.org/#/c/84875/http://www.securityfocus.com/bid/103433https://access.redhat.com/errata/RHBA-2018:0135https://bugzilla.redhat.com/show_bug.cgi?id=1549944https://gerrit.ovirt.org/#/c/84861/https://gerrit.ovirt.org/#/c/84875/
2018-03-06
Published