CVE-2014-3559
Red Hat Enterprise Virtualization 3.4 - Information Disclosure via Uninitialized Storage Volume
Title source: llmDescription
The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1030664
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/95098
Vendor Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1002.html
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1121925
Scores
EPSS
0.0144
EPSS Percentile
70.5%
Details
CWE
CWE-264
Status
published
Products (1)
redhat/enterprise_virtualization
3.4
Published
Aug 06, 2014
Tracked Since
Feb 18, 2026