CVE-2014-3559
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots...
CVE-2014-3559 is a low vulnerability (CVSS 3.5) in Redhat Enterprise Virtualization, published August 6, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. Fixed in rhevm 0:3.4.1-0.31.el6ev.
- Severity
- 3.5 LowCVSS 2.0, NVD
- Exploit chance
- 1.44%EPSS, 73rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0:3.4.1-0.31.el6evrhevm +14 more
Description
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rhevmRed Hat:rhev_manager:3 | before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-backendRed Hat:rhev_manager:3 | before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-dbscriptsRed Hat:rhev_manager:3 | before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-libRed Hat:rhev_manager:3 | before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-restapiRed Hat:rhev_manager:3 | before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-setupRed Hat:rhev_manager:3 | before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-setup-baseRed Hat:rhev_manager:3 | before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-setup-plugin-allinoneRed Hat:rhev_manager:3 | before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-setup-plugin-ovirt-engineRed Hat:rhev_manager:3 | before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-setup-plugin-ovirt-engine-commonRed Hat:rhev_manager:3 | before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rhevm-setup-plugin-websocket-proxyRed Hat:rhev_manager:3 | before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-toolsRed Hat:rhev_manager:3 | before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-userportalRed Hat:rhev_manager:3 | before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-webadmin-portalRed Hat:rhev_manager:3 | before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
rhevm-websocket-proxyRed Hat:rhev_manager:3 | before 0:3.4.1-0.31.el6ev | 0:3.4.1-0.31.el6ev |
What each source reports
NVD Score used
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.
- Record
CVE-2014-3559- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.
- Record
CVE-2014-3559- Updated
- 2026-11-02
EUVDEUVD-2014-3541No score
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.
- Record
EUVD-2014-3541- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-24xc-rjq3-m9pjNo score
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots...
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.
- Record
GHSA-24xc-rjq3-m9pj- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.