Description
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 3 | rhevm +14 | 3.4.1-0.31.el6ev | RHSA-2014:1002 |
Advisories 1
- RHSA-2014:1002 Red Hat Security Advisory: rhevm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- 1030664 vdb-entry
- virtualizationmanager-cve20143559-info-disc(95098) vdb-entry
- RHSA-2014:1002 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1121925