PT-2014-5395 · Red Hat · Red Hat Enterprise Virtualization

Published 2014-08-06 · Updated 2023-02-13 · CVE-2014-3559

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Virtualization version 3.4

Description The issue concerns the oVirt storage backend, which fails to wipe memory snapshots when a virtual machine (VM) is deleted, even if wipe-after-delete (WAD) is configured for the VM's disk. This allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.

Recommendations For Red Hat Enterprise Virtualization version 3.4, consider configuring additional security measures to protect sensitive information, as the current wipe-after-delete functionality does not fully address the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-3559

RHSA-2014:1002

Affected Products

Red Hat Enterprise Virtualization

References · 5

• http://rhn.redhat.com/errata/RHSA-2014-1002.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3559 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1121925 · Note
• http://securitytracker.com/id/1030664 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95098 · Note