CVE-2012-5625

Openstack nova: information leak in libvirt lvm-backed instances

6.5 MediumFix available

CVE-2012-5625 is a medium vulnerability (CVSS 6.5) in Openstack Folsom, published December 26, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.34%, the 71st percentile. Fixed in nova 12.0.0a0.

What does this mean?

Severity: 6.5 MediumCVSS 3.1, CVE List
Exploit chance: 1.34%EPSS, 71st percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 12.0.0a0nova +13 more

Description

OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive information by reading the memory of the previous logical volume (LV).

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

1.34%Down 0.2 points since Feb 4, 2022

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`nova` PyPI	before 12.0.0a0	12.0.0a0
`nova` PyPI	Not stated	Not evaluated
`openstack-nova` Red Hat:openstack:2::el6 From an advisory covering 2 CVEs	before 0:2012.2.2-8.el6ost	0:2012.2.2-8.el6ost
`openstack-nova-api` Red Hat:openstack:2::el6 From an advisory covering 2 CVEs	before 0:2012.2.2-8.el6ost	0:2012.2.2-8.el6ost
`openstack-nova-cert` Red Hat:openstack:2::el6 From an advisory covering 2 CVEs	before 0:2012.2.2-8.el6ost	0:2012.2.2-8.el6ost
`openstack-nova-common` Red Hat:openstack:2::el6 From an advisory covering 2 CVEs	before 0:2012.2.2-8.el6ost	0:2012.2.2-8.el6ost
`openstack-nova-compute` Red Hat:openstack:2::el6 From an advisory covering 2 CVEs	before 0:2012.2.2-8.el6ost	0:2012.2.2-8.el6ost
`openstack-nova-console` Red Hat:openstack:2::el6 From an advisory covering 2 CVEs	before 0:2012.2.2-8.el6ost	0:2012.2.2-8.el6ost
`openstack-nova-doc` Red Hat:openstack:2::el6 From an advisory covering 2 CVEs	before 0:2012.2.2-8.el6ost	0:2012.2.2-8.el6ost
`openstack-nova-network` Red Hat:openstack:2::el6 From an advisory covering 2 CVEs	before 0:2012.2.2-8.el6ost	0:2012.2.2-8.el6ost

Show 4 moreShow less

Affected packages
Package	Affected	Fixed
`openstack-nova-objectstore` Red Hat:openstack:2::el6 From an advisory covering 2 CVEs	before 0:2012.2.2-8.el6ost	0:2012.2.2-8.el6ost
`openstack-nova-scheduler` Red Hat:openstack:2::el6 From an advisory covering 2 CVEs	before 0:2012.2.2-8.el6ost	0:2012.2.2-8.el6ost
`openstack-nova-volume` Red Hat:openstack:2::el6 From an advisory covering 2 CVEs	before 0:2012.2.2-8.el6ost	0:2012.2.2-8.el6ost
`python-nova` Red Hat:openstack:2::el6 From an advisory covering 2 CVEs	before 0:2012.2.2-8.el6ost	0:2012.2.2-8.el6ost

Not evaluated means the source gave git commits or a range we can't read, so we can't tell which releases are affected. A fixed version beside it is the source’s own claim.