CVE-2012-5625
Openstack nova: information leak in libvirt lvm-backed instances
- State
- Published
- Severity
- 6.5 Medium
- Published
- Dec 26, 2012
- Updated
- Oct 30, 2026
- Reserved
- Oct 24, 2012
Description
OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive information by reading the memory of the previous logical volume (LV).
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | redhat |
Weaknesses
- CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
Affected Products
| Product | Versions |
|---|---|
OpenStack Folsom for RHEL 6Red Hat |
|
Red Hat OpenStack Platform 16.2Red Hat | |
Red Hat OpenStack Platform 17.1Red Hat | |
Red Hat OpenStack Platform 18.0Red Hat |
References
- http://osvdb.org/88419
- http://rhn.redhat.com/errata/RHSA-2013-0208.html
- http://www.openwall.com/lists/oss-security/2012/12/11/5
- http://www.securityfocus.com/bid/56904
- http://www.ubuntu.com/usn/USN-1663-1
- RHSA-2013:0208vendor-advisory
- https://access.redhat.com/security/cve/CVE-2012-5625vdb-entry
- https://bugs.launchpad.net/nova/+bug/1070539
- https://bugzilla.redhat.com/show_bug.cgi?id=884293
- https://github.com/openstack/nova/commit/9d2ea970422591f8cdc394001be9a2deca499a5f
- https://github.com/openstack/nova/commit/a99a802e008eed18e39fc1d98170edc495cbd354
- https://launchpad.net/nova/folsom/2012.2.2
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.