Description

A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed from a VM. If the same storage blocks happen to be later allocated to a new disk attached to another VM, potentially sensitive data could be revealed to privileged users of that VM.

Remediation

References

http://www.securityfocus.com/bid/103433

https://access.redhat.com/errata/RHBA-2018:0135

https://bugzilla.redhat.com/show_bug.cgi?id=1549944

https://gerrit.ovirt.org/#/c/84861/

https://gerrit.ovirt.org/#/c/84875/

Related Vulnerabilities

CVE-2019-20921 Vulnerability in maven package org.webjars.bowergithub.snapappointments:bootstrap-select

CVE-2016-10744 Vulnerability in maven package org.webjars.bower:select2

CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.sonos

CVE-2015-6420 Vulnerability in maven package commons-collections:commons-collections

CVE-2022-25646 Vulnerability in npm package x-data-spreadsheet

Severity

Medium

Classification

CWE-212 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Third Party Advisory VDB Entry Issue Tracking Vendor Advisory