CVE-2012-5625

Openstack nova: information leak in libvirt lvm-backed instances

6.5 MediumFix available

OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive information by reading the memory of the previous logical volume (LV).

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

1.35%Down 0.2 points since Feb 4, 2022

What each source reports

CVE List Score used 6.5

Openstack nova: information leak in libvirt lvm-backed instances

Record: CVE-2012-5625
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-212
Updated: 2026-11-02

EUVDEUVD-2012-0024 6.5

Record: EUVD-2012-0024
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rwhr-h69g-8qmq No score

OpenStack Nova Information leak in libvirt LVM-backed instances

Record: GHSA-rwhr-h69g-8qmq
Weakness: CWE-200
Updated: 2026-11-02

NVD 6.5

Record: CVE-2012-5625
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness: CWE-212, CWE-200
Updated: 2026-11-02

OSVGHSA-rwhr-h69g-8qmq No score

OpenStack Nova Information leak in libvirt LVM-backed instances

Record: GHSA-rwhr-h69g-8qmq
Weakness: CWE-200
Updated: 2026-11-02

OSVPYSEC-2012-41 No score

Record: PYSEC-2012-41
Updated: 2026-11-02

OSVPYSEC-2012-42 No score

Record: PYSEC-2012-42
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`nova` PyPI	before 12.0.0a0	12.0.0a0
`nova` PyPI	Not stated	Not evaluated

Not evaluated means the source gave git commits or a range we can't read, so we can't tell which releases are affected. A fixed version beside it is the source’s own claim.

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-5625 is a medium vulnerability (CVSS 6.5) in Openstack Folsom, published December 26, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.35%, the 71st percentile. Fixed in nova 12.0.0a0.

References

Show 11 moreShow less