Description
The MoveDisk command in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier does not properly check permissions on storage domains, which allows remote authenticated storage admins to cause a denial of service (free space consumption of other storage domains) via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 3 | rhevm +11 | 3.1.0-43.el6ev | RHSA-2013:0211 |
Advisories 1
- RHSA-2013:0211 Red Hat Security Advisory: rhevm 3.1.2 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=893355
- RHSA-2013:0211 vendor-advisory
- entreprise-movedisk-dos(81834) vdb-entry
- 1028076 vdb-entry
- 57750 vdb-entry