CVE-2012-5625

Description

OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive information by reading the memory of the previous logical volume (LV).

How to fix CVE-2012-5625

To remediate CVE-2012-5625, upgrade the affected package to a fixed version below.

• PyPI/nova—upgrade to 12.0.0a0 or later
• PyPI/nova—upgrade to a99a802e008eed18e39fc1d98170edc495cbd354 or later
• —no fix listed

Is CVE-2012-5625 being exploited?

Low — EPSS is 1.1%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0, < 12.0.0a0
• from 0, < a99a802e008eed18e39fc1d98170edc495cbd354, < 9d2ea970422591f8cdc394001be9a2deca499a5f | from 0

References (15)

• ADVISORYgithub.com/advisories/GHSA-rwhr-h69g-8qmq
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2012-5625
• PATCHgithub.com/openstack/nova
• WEBosvdb.org/88419
• WEBrhn.redhat.com/errata/RHSA-2013-0208.html