CVE-2014-3559
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots...
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.
Exploit likelihood
What each source reports
NVD Score used
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.
- Record
CVE-2014-3559- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.
- Record
CVE-2014-3559- Updated
- 2026-11-02
EUVDEUVD-2014-3541 No score
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.
- Record
EUVD-2014-3541- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-24xc-rjq3-m9pj No score
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots...
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.
- Record
GHSA-24xc-rjq3-m9pj- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rhevmRed Hat:rhev_manager:3 |
before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-backendRed Hat:rhev_manager:3 |
before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-dbscriptsRed Hat:rhev_manager:3 |
before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-libRed Hat:rhev_manager:3 |
before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-restapiRed Hat:rhev_manager:3 |
before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-setupRed Hat:rhev_manager:3 |
before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-setup-baseRed Hat:rhev_manager:3 |
before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-setup-plugin-allinoneRed Hat:rhev_manager:3 |
before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-setup-plugin-ovirt-engineRed Hat:rhev_manager:3 |
before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-setup-plugin-ovirt-engine-commonRed Hat:rhev_manager:3 |
before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rhevm-setup-plugin-websocket-proxyRed Hat:rhev_manager:3 |
before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-toolsRed Hat:rhev_manager:3 |
before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-userportalRed Hat:rhev_manager:3 |
before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-webadmin-portalRed Hat:rhev_manager:3 |
before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-websocket-proxyRed Hat:rhev_manager:3 |
before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3559 is a low vulnerability (CVSS 3.5) in Redhat Enterprise Virtualization, published August 6, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. Fixed in rhevm 0:3.4.1-0.31.el6ev.